Critical SQL Injection Flaw Found in EduAdmin Booking Before Version 6.0.0

The National Vulnerability Database (NVD) has published a record for CVE-2026-96809, identifying a critical security flaw in the EduAdmin Booking application developed by MultiNet Interactive AB. The vulnerability enables blind SQL injection attacks, posing a significant risk to the integrity and confidentiality of data stored within the scheduling platform.

According to the NVD record, the issue stems from improper neutralization of special elements used in SQL commands. This specific weakness, categorized under CWE-89, allows an attacker to insert malicious SQL code into input fields. Because the vulnerability permits blind SQL injection, an attacker can extract data from the database even if the application does not directly display the results of the injected query. The NVD assigns a CVSS score of 9.3 to this vulnerability, classifying it as critical.

Technical Context and Severity

The classification of this flaw as critical reflects the high potential for data compromise. SQL injection remains one of the most prevalent and dangerous web application vulnerabilities. In the case of blind SQL injection, the attacker sends requests to the database and observes the application's response or behavior to infer the contents of the database. This technique can be used to bypass authentication, access sensitive user information, or manipulate data records.

The Common Weakness Enumeration (CWE-89) entry for this issue highlights the failure to properly sanitize input before it is used in an SQL command. This lack of neutralization creates an execution path for arbitrary code within the database environment. With a CVSS score of 9.3, the risk is deemed severe, indicating that successful exploitation requires minimal complexity and can have a high impact on confidentiality, integrity, and availability.

Affected Systems and Scope

The vulnerability affects the EduAdmin Booking software produced by MultiNet Interactive AB. According to the NVD, the issue impacts all versions of the application from the initial release up to, but not including, version 6.0.0. The record specifies the affected range as "from n/a before 6.0.0," indicating that any deployment running an older version is potentially exposed.

Organizations relying on EduAdmin Booking for scheduling and administrative tasks should verify their current version immediately. If the installed version is below 6.0.0, the system is considered vulnerable. There is no indication in the current NVD record that a patch has been issued for versions prior to 6.0.0 other than the release of version 6.0.0 itself. Therefore, upgrading to version 6.0.0 or later is the primary method to mitigate this specific risk, assuming such an upgrade is available and supported by the vendor.

What should you do?

Security professionals should audit their environments to identify any instances of EduAdmin Booking running versions prior to 6.0.0. Until a confirmed fix or upgrade is applied, organizations should consider restricting external access to the application and implementing web application firewalls to detect potential SQL injection patterns.