The vulnerability exists in the save_stud.php script where the fname, lname, and student_class parameters are inserted directly into SQL queries without proper sanitization. An attacker can inject arbitrary SQL, allowing extraction, modification, or deletion of student enrollment data. This can compromise the confidentiality of personal information and the integrity of enrollment records, and may ultimately lead to full database compromise if further weaknesses exist.

Sourcecodester CASAP Automated Enrollment System 1.0 – the open‑source web application used for automated student enrollment. No other products or versions are listed as affected.

With a CVSS score of 9.8 the vulnerability is considered critical. The EPSS score of less than 1% indicates that, while the threat is severe, the likelihood of immediate exploitation is low, and it is not currently listed in CISA’s KEV catalog. The attack vector is likely web‑based, requiring an unauthenticated or low‑privileged attacker to supply crafted input to the vulnerable parameters. Successful exploitation would permit the attacker to manipulate the database and potentially pivot to higher‑level compromise if database privileges are excessive.