Key points
- The flaw, tracked as CVE-2026-96809, carries a CVSS score of 9.3, rated as critical severity.
- It affects all versions of EduAdmin Booking prior to 6.0.0.
- The vulnerability is classified as CWE-89, involving improper neutralization of special elements in SQL commands.
MultiNet Interactive AB has a critical security issue in its EduAdmin Booking software. The problem allows attackers to perform blind SQL injection, a technique that can expose or alter data in the application’s database. The flaw exists in every version of the product released before 6.0.0. Users running those older versions are exposed to significant risk until they upgrade or apply available mitigations.
In plain English
SQL injection happens when an application takes user input and puts it directly into a database query without proper sanitization. In this specific case, the vulnerability is a "blind" SQL injection. This means the attacker might not see the database results directly on the screen, but they can infer information based on how the application responds to their queries.
Think of it like asking a librarian a question where the answer is only a nod or a shake of the head. By asking many specific questions, an attacker can slowly piece together sensitive data, such as user credentials or booking details, even without seeing the raw data. The National Vulnerability Database describes this as improper neutralization of special elements used in an SQL command.
The background
The vulnerability is identified as CVE-2026-96809. Security researchers have assigned it a Common Vulnerability Scoring System (CVSS) score of 9.3, which places it in the critical category. The weakness is categorized under CWE-89, a standard code for SQL injection flaws.
The issue affects the EduAdmin Booking component developed by MultiNet Interactive AB. According to the NVD record, the vulnerability is present in all versions of the software prior to 6.0.0. There is no mention of a patch for versions below 6.0.0 in the provided source material; the implication is that upgrading to 6.0.0 or later resolves the issue.
What changes now
Organizations using EduAdmin Booking must verify their current version immediately. If the version number is below 6.0.0, the system is vulnerable. Administrators should prioritize upgrading to version 6.0.0 or newer to eliminate the flaw. Until an upgrade is possible, systems should be monitored for unusual database activity or unexpected application responses, which could indicate an ongoing blind SQL injection attack.
What to do and how to stay safe: EduAdmin Booking
- Check the current version of EduAdmin Booking installed on your servers.
- Upgrade to version 6.0.0 or later to remove the vulnerability.
- Monitor database logs for unusual query patterns or delayed responses that might indicate blind SQL injection attempts.
- Restrict database permissions for the application account to limit the impact if an injection occurs.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-96809?
It is a critical SQL injection vulnerability in EduAdmin Booking that allows blind SQL injection attacks.
Which versions of EduAdmin Booking are affected?
All versions before 6.0.0 are affected by this vulnerability.
How severe is this vulnerability?
It has a CVSS score of 9.3, which is rated as critical.
