Cyber Resilience

CVE-2026-36234

CriticalPublic PoC

Published: 10 April 2026

Published
10 April 2026
Modified
14 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0032 23.5th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-36234 is a critical-severity SQL Injection (CWE-89) vulnerability in Itsourcecode Online Student Enrollment System. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-36234 is a SQL injection vulnerability (CWE-89) in the itsourcecode Online Student Enrollment System version 1.0. The flaw resides in the newCourse.php component and is triggered via the 'coursename' parameter, allowing malicious SQL payloads to be injected into database queries. Published on 2026-04-10, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for widespread impact.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation enables arbitrary SQL query execution, granting high-impact access to confidential data (C:H), modification of database contents (I:H), and disruption of system availability (A:H), which could lead to full database compromise, data exfiltration, or unauthorized administrative actions.

Details on the vulnerability, including proof-of-concept exploitation, are documented in the reference at https://github.com/Amorsec/CVE-PHP/blob/main/itsourcecode-Online_Student_Enrollment_System_in_newCourse.php_sql_injection.pdf. No patch or mitigation guidance is specified in the available sources.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

itsourcecode Online Student Enrollment System v1.0 is vulnerable to SQL Injection in newCourse.php via the 'coursename' parameter.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Unauthenticated remote SQL injection in public-facing web app (newCourse.php) directly enables T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-36233Same product: Itsourcecode Online Student Enrollment System
CVE-2026-36232Same product: Itsourcecode Online Student Enrollment System
CVE-2026-36235Same product: Itsourcecode Online Student Enrollment System
CVE-2026-1176Same vendor: Itsourcecode
CVE-2026-2012Same vendor: Itsourcecode
CVE-2026-2014Same vendor: Itsourcecode
CVE-2026-3730Same vendor: Itsourcecode
CVE-2026-2190Same vendor: Itsourcecode
CVE-2026-2013Same vendor: Itsourcecode
CVE-2026-2073Same vendor: Itsourcecode

Affected Assets

itsourcecode
online student enrollment system
1.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validating the 'coursename' parameter in newCourse.php to prevent SQL injection payloads from altering database queries.

SI-2 Flaw Remediation good match
prevent

Mandates timely identification, reporting, and correction of the SQL injection flaw in the itsourcecode Online Student Enrollment System v1.0.

RA-5 Vulnerability Monitoring and Scanning partial match
preventdetect

Provides vulnerability scanning to detect the SQLi vulnerability in newCourse.php and triggers remediation to mitigate exploitation.

References