The Prison Management System version 1.0 contains a classic SQL injection flaw—CWE‑89—that allows an attacker to supply malicious input via the username field on the admin login page. This input can modify the database query executed by the server, potentially enabling data extraction, modification of records, or privilege escalation depending on the underlying database permissions. The vulnerability directly impacts confidentiality and integrity of the system’s stored information.

The affected product is the PHP-based Prison Management System, version 1.0, distributed to correctional facilities and related administrative environments.

The EPSS score is not available, and the vulnerability is not listed as a CISA KEV, so current exploitation data is unknown. However, the nature of the flaw—unfiltered username input used in a database query—provides a straightforward attack path for anyone who can reach the login page. Without proper mitigation, the risk of exploitation is significant, particularly in contexts where the database user has broad access rights.