A flaw in the admin/sum.php script of itsourcecode Online Admission System allows an attacker to manipulate the ID argument sent to the backend, resulting in a SQL injection. The vulnerability is exploitable from a remote source and can be used to read or modify data stored in the system's database, potentially exposing sensitive student application information. This flaw corresponds to improper input handling and unchecked database queries (CWE-74 and CWE-89).

The product affected is itsourcecode Online Admission System version 1.0. The vulnerability resides in the /admin/sum.php page, a component of the web application used for admission processing. No other product versions are explicitly listed as affected.

The CVSS score of 5.3 indicates moderate severity, reflecting the ability to execute remote SQL code but lacking advanced privilege escalation or widespread impact. EPSS scores are not available, and the flaw is not listed in the CISA KEV catalog, so current exploitation activity is uncertain. However, because the flaw is publicly disclosed and the attack can be launched remotely, organizations should consider it a credible threat that could lead to confidentiality breaches if a database contains sensitive admission data. The likely attack vector involves an unauthenticated web request to the vulnerable script, sending a crafted ID parameter that is embedded directly into a SQL statement.