External risk intelligence

itsourcecode Online Student Enrollment System SQL Injection in newCourse.php

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-36234

The vulnerability exists in an Online Student Enrollment System, which is typically deployed as a web application accessible over the network to allow students or users to register for courses. As a web-facing enrollment portal, it is commonly exposed to the internet or wide internal networks for user interaction.

SQL Injection

Itsourcecode Online Student Enrollment System

1.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the itsourcecode Online Student Enrollment System, specifically related to how it handles course name input. This flaw could allow unauthorized access to or manipulation of the system's underlying data, potentially impacting the integrity of student records.

A data input flaw can expose student enrollment system.
Critical flaw impacts student registration data integrity.
Confirm relevance and exposure of enrollment system.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending a specially crafted request to the `newCourse.php` script. This script handles new course registrations and is susceptible to SQL injection through the `coursename` parameter. By manipulating this parameter, an attacker could potentially gain unauthorized access to sensitive data or alter system information.

No authentication required.
`coursename` parameter in `newCourse.php`.
Data exposure and manipulation risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Online Student Enrollment System could allow an unauthenticated attacker to inject malicious SQL code through the 'coursename' parameter in newCourse.php. This could lead to unauthorized access, modification, or deletion of sensitive student and course data stored within the system's database.

Student and course data in the database.
SQL injection via a web parameter.
Unauthorized access and data manipulation.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in the itsourcecode Online Student Enrollment System requires immediate attention from application owners and potentially the platform or infrastructure teams responsible for its deployment. The first practical step is to identify all instances of this system within your environment, confirm their network exposure and criticality to business operations, and then establish direct contact with the accountable owner to initiate a risk-based remediation plan.

Application owners should investigate.
Verify system exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the itsourcecode Online Student Enrollment System?

This software is a web-based application designed to manage and automate the registration of students into academic courses. It serves as a digital portal where users interact with a database to add or manage course information, typically running on a server accessible to students and administrative staff.

What does SQL injection mean for CVE-2026-36234?

This vulnerability, classified as CWE-89, happens when the system improperly handles user-provided data. Instead of treating the 'coursename' input as plain text, the application mistakenly executes it as a database command. This allows unauthorized parties to manipulate the underlying data structures, potentially viewing or changing sensitive records.

How can an attacker trigger this vulnerability?

An attacker can trigger the flaw by sending a specially crafted request to the 'newCourse.php' script, targeting the 'coursename' parameter. Because the system does not require authentication, anyone with network access to the page can attempt this. Simply navigating the site normally or submitting valid, expected data does not trigger the bug.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a high-priority concern because enrollment systems are typically deployed as web-facing portals. Since the application is designed to be reachable over a network for user registrations, it is often exposed to the internet or wide internal networks, significantly increasing the likelihood that an attacker could reach the vulnerable component.

Do I need to take action to secure the system?

Yes. If you run this software, locate every deployment within your network to understand where it is active. Assess how critical the specific instance is to your daily operations and verify if it is reachable by untrusted users. Coordinate with your team to review the application and prioritize the necessary security updates or configuration changes.

References

github.com/Amorsec/CVE-PHP/blob/main/itsourcecode-Online_Student…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.