An unknown function in the /admin/creteria.php file of the Online Admission System accepts an ID parameter that is not properly validated, allowing an attacker to inject arbitrary SQL commands. The exploitation can be performed from anywhere on the Internet, and the injection can be used to read, modify, or delete data from the underlying database, potentially exposing sensitive information or corrupting application data.

The vulnerability affects itsourcecode's Online Admission System version 1.0. No other product or version information is supplied in the data.

The reported CVSS score of 6.9 indicates a medium severity flaw. Because the EPSS score is not available and the vulnerability is not listed in the KEV catalog, the current exploitation probability is not quantified. The vulnerability is publicly disclosed and can be triggered remotely through the web interface, meaning that any exposed web server running the affected application is at risk until the flaw is remediated.