Based on the description, it is inferred that the Prison Management System version 1.0 contains a classic SQL injection flaw—CWE‑89—that allows an attacker to supply malicious input via the username field on the admin login page. This input can modify the database query executed by the server, potentially enabling data extraction, modification of records, or privilege escalation depending on the underlying database permissions. The vulnerability directly impacts confidentiality and integrity of the system’s stored information.

The affected product is the PHP-based Prison Management System, version 1.0.

The EPSS score is reported as < 1% and the CVSS score is 7.3, indicating a medium‑high severity and a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, so current exploitation data is unknown. Based on the description, the likely attack vector is the web login endpoint where a malicious user can inject SQL via the username parameter. However, the nature of the flaw—unfiltered username input used in a database query—provides a straightforward attack path for anyone who can reach the login page. Without proper mitigation, the risk of exploitation is significant, particularly in contexts where the database user has broad access rights.