A flaw exists in the Online Application System for Admission that causes the file /enrollment/database/oas.sql to store sensitive information insecurely. By manipulating an unknown function within this file, an attacker can gain unauthorized access to confidential data. The vulnerability allows remote exploitation, and the method to trigger it has been publicly disclosed, enabling attackers to craft an exploit script or manual request.

The issue affects version 1.0 of the code-projects Online Application System for Admission. The affected component is the oas.sql file located in the /enrollment/database directory. No other product or version information is currently available.

The CVSS score of 6.9 classifies the vulnerability as moderate severity, and a public exploit is already circulating. Because exploitation can be performed remotely, attackers do not require local privileges to compromise the data. The EPSS value is not provided, and the vulnerability is not included in the CISA KEV catalog, but the presence of a public exploit suggests a tangible risk. Users with remote access to the application should consider this a critical issue until remediation is applied.