Security readout for executives and security teams
Plain-English summary
CVE-2026-0803 is a SQL injection issue in PHPGurukul Online Course Registration System through version 3.1. A user with application access may be able to manipulate enrollment data requests and affect the database. Public exploit information exists, but active exploitation is not confirmed by KEV or the provided sources.
Executive priority
Treat as a near-term remediation item for exposed student systems. The issue is not confirmed as actively exploited, but public exploit availability raises risk for internet-accessible deployments.
Technical view
The issue affects /enroll.php and involves parameters including studentregno, Pincode, session, department, level, course, and sem. VulDB rates it 6.5 CVSS v2 with network access, low complexity, and single authentication required. Impact is partial confidentiality, integrity, and availability loss.
Likely exposure
Primarily organizations running PHPGurukul Online Course Registration System versions 3.0 or 3.1, especially if reachable from the internet or accessible to many students/users.
Exploitation context
The sources state the attack can be launched remotely and that exploit material has been made public. CVSS indicates authentication is required. No provided source confirms active exploitation in the wild.
Researcher notes
Evidence identifies SQL injection in /enroll.php but describes the affected code area as unknown. The source bundle does not name a vendor patch, fixed version, or official workaround. Avoid assuming broader PHPGurukul products are affected.
Mitigation direction
- Identify any PHPGurukul Online Course Registration System deployments and versions.
- Check PHPGurukul guidance for an official fix or updated release.
- Restrict access to enrollment functions where operationally possible.
- Review /enroll.php input handling for parameterized queries and validation.
- Increase monitoring for suspicious enrollment-page database errors or abnormal requests.
Validation and detection
- Confirm whether versions 3.0 or 3.1 are deployed.
- Determine whether /enroll.php is reachable by untrusted users.
- Review logs for unusual activity involving affected enrollment parameters.
- Verify database queries use safe parameterization for enrollment inputs.
- Track vendor and VulDB updates for remediation details.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-74: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-0803 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR86.4Primary CVE scoreVulnerability scoring details
Base CVSS 2.0 score
6.5MediumVector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
Source materials
- CVE List V5 sourceCVE List V5
- VDB-340255 | PHPGurukul Online Course Registration System enroll.php sql injectionCVE reference · vdb-entry, technical-description
- VDB-340255 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference · signature, permissions-required
- Submit #733344 | PHPGurukul Online Course Registration System ≤ 3.1 SQL InjectionCVE reference · third-party-advisory
- https://note-hxlab.wetolink.com/share/qX132pk8WofkCVE reference · exploit
- https://phpgurukul.com/CVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.