A flaw in itsourcecode Online Admission System 1.0 allows an attacker to manipulate the schedid parameter in the /new.php endpoint, resulting in unfiltered SQL statements. The vulnerability is a classic SQL injection that can be exploited remotely by crafting a malicious schedid value. The attacker could read, modify, or delete database records, or insert arbitrary data, compromising confidentiality, integrity, and potentially disrupting admission processes. The weakness corresponds to CWE-74 and CWE-89.

The affected product is itsourcecode Online Admission System version 1.0. The vulnerability exists in the file /new.php at the schedid parameter. No other versions are known to be impacted.

The CVSS score of 5.3 indicates medium severity, and no EPSS data or KEV listing is available, suggesting limited evidence of widespread exploitation. However, a public exploit exists and attackers can trigger the injection remotely from any network with access to the application. Because the flaw allows direct manipulation of SQL, the risk to the organization includes data loss, privacy violations, and potential service disruption. The attack is feasible without local privileges and relies on remote network reachability to the vulnerable endpoint.