Sourcecodester CASAP Automated Enrollment System 1.0 contains an SQL injection flaw in the update_class.php script that reads the class_name parameter from the HTTP request and directly concatenates it into a SQL query. An attacker who crafts a malicious class_name value can inject arbitrary SQL, enabling unauthorized data extraction, modification, or deletion from the underlying database. This flaw permits an attacker to compromise the confidentiality, integrity, and availability of the entire system’s data.

The vulnerability affects the Sourcecodester CASAP Automated Enrollment System version 1.0.

The CVSS score of 9.8 classifies this issue as critical, indicating a high likelihood of catastrophic impact if exploited. The EPSS score of less than 1% suggests that, at present, the probability of real-world exploitation is low, possibly due to the niche nature of the application or lack of widespread discovery. The vulnerability is not listed in CISA’s KEV catalog, and due to the absence of explicit authentication requirements in the description, it is inferred that the attack vector is an unauthenticated remote web request to the update_class.php endpoint.