CVE-2026-5650: Online Admission System Info Disclosure

CVE-2026-5650 Overview

CVE-2026-5650 is an information disclosure vulnerability affecting the Online Application System for Admission version 1.0 developed by code-projects. The vulnerability exists due to insecure storage of sensitive information in the file /enrollment/database/oas.sql, which exposes a database backup containing potentially sensitive user and application data. This issue can be exploited remotely without authentication, allowing attackers to access confidential information stored within the exposed SQL file.

Critical Impact

Exposed database backup files may contain sensitive user credentials, personal information, and application data that could be leveraged for identity theft, account compromise, or further attacks against the admission system.

Affected Products

• code-projects Online Application System for Admission 1.0
• Systems with publicly accessible /enrollment/database/oas.sql file
• PHP-based admission systems with exposed database backups

Discovery Timeline

• 2026-04-06 - CVE-2026-5650 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-5650

Vulnerability Analysis

This vulnerability falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The core issue stems from a database backup file being stored in a web-accessible directory without proper access controls. The oas.sql file located at /enrollment/database/oas.sql contains database schema and potentially sensitive data that should never be accessible via web requests.

The vulnerability allows unauthenticated remote attackers to directly access and download the SQL backup file. This exposed database backup may contain user credentials, personal identification information, admission records, and other sensitive data that attackers can harvest for malicious purposes.

Root Cause

The root cause of this vulnerability is improper file placement and missing access controls. Database backup files were stored within the web root directory structure without implementing proper access restrictions such as .htaccess rules, directory indexing prevention, or moving sensitive files outside the publicly accessible web directory. This configuration flaw allows direct HTTP requests to retrieve the backup file.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by simply navigating to or requesting the exposed SQL file path directly through a web browser or HTTP client. The attack is trivial to execute and requires minimal technical skill.

The exploitation process involves:

1. Identifying the target Online Application System for Admission installation
2. Requesting the /enrollment/database/oas.sql file directly via HTTP
3. Downloading and analyzing the SQL file contents for sensitive data
4. Extracting credentials, personal information, or other sensitive data for malicious use

Detection Methods for CVE-2026-5650

Indicators of Compromise

• Unusual HTTP GET requests targeting /enrollment/database/oas.sql or similar database backup file paths
• Web server access logs showing successful downloads of .sql files from database directories
• External IP addresses repeatedly accessing backup file locations
• Evidence of data exfiltration following database file access

Detection Strategies

• Monitor web server access logs for requests to database file extensions (.sql, .db, .sqlite, .bak) in web-accessible directories
• Implement web application firewall (WAF) rules to block direct access to database file extensions
• Deploy file integrity monitoring on sensitive directories to detect unauthorized access
• Use security scanning tools to identify exposed backup files and sensitive data leakage

Monitoring Recommendations

• Configure real-time alerting for access attempts to database backup directories
• Regularly audit web-accessible directories for sensitive file exposure using automated security scanners
• Implement SentinelOne endpoint monitoring to detect and alert on suspicious file access patterns
• Review and monitor web server configurations for proper access control enforcement

How to Mitigate CVE-2026-5650

Immediate Actions Required

• Remove the oas.sql database backup file from the web-accessible directory immediately
• Move all database backups outside the web root directory structure
• Implement .htaccess or web server configuration rules to deny access to sensitive file types
• Review web server access logs to identify any prior unauthorized downloads of the exposed file
• If the backup was downloaded, assume all contained credentials are compromised and rotate accordingly

Patch Information

No official vendor patch information is currently available for this vulnerability. Administrators should implement the recommended workarounds to mitigate the risk. For more information about this vulnerability, refer to the VulDB Vulnerability Report #355438 and the GitHub CVE Information Disclosure report.

Workarounds

• Move all database backup files to a directory outside the web root (e.g., /var/backups/ or a non-web-accessible location)
• Add web server access rules to deny requests to database file extensions
• Implement directory browsing restrictions to prevent file enumeration
• Encrypt sensitive backup files and store them securely with proper access controls
• Consider using SentinelOne's data protection capabilities to monitor and protect sensitive file access

# Apache .htaccess configuration to block SQL file access
<FilesMatch "\.(sql|db|sqlite|bak|mdb)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Nginx configuration to deny database file access
location ~* \.(sql|db|sqlite|bak|mdb)$ {
    deny all;
    return 403;
}