The vulnerability allows an attacker to inject arbitrary SQL statements through the fname and student_class parameters of the update_student.php script. This flaw is a classic SQL Injection (CWE‑89) that could enable extraction of confidential data or modification of student records. Based on the description, it is inferred that the attacker might also be able to hijack sessions if the application grants elevated privileges to the affected user. The vendor’s official description lists the impact as manipulation of application data via unsanitized input.

Sourcecodester CASAP Automated Enrollment System 1.0 is the only product identified as affected. No additional vendor or product details are supplied by the CNA. Users of this version should assume that the update_student.php endpoint is vulnerable unless a newer version with a fix is applied.

The CVSS score of 7.3 reflects a high severity attack that could compromise data confidentiality and integrity. The EPSS score is listed as < 1%, indicating a low probability of immediate exploitation, although the factor does not negate the risk. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the web interface, with the attacker needing to supply crafted input to the fname or student_class fields. No specific system prerequisites are noted, implying the flaw could be abused by external web requests that reach the vulnerable endpoint.