A classic SQL injection flaw exists in the update_password.php script when the new_password field is processed. This weakness, identified as CWE-89, can enable an attacker to read, modify, or delete database content, thereby exposing confidential information or disrupting system integrity.

Sourcecodester CASAP Automated Enrollment System 1.0, a PHP web application. The flaw resides in the update_password.php file that handles user password changes.

The CVSS base score is 7.3, indicating a high severity of potential impact. The EPSS score is below 1%, signifying a very low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote via HTTP requests to the publicly exposed script; the necessity of authentication is not explicitly documented but is a reasonable assumption for a password update endpoint.