The vulnerability resides in the /save_user.php script of the CASAP Automated Enrollment System, where the status parameter is concatenated directly into an SQL query. An attacker can supply crafted input to inject arbitrary SQL statements, enabling read, update, or delete operations on the underlying database. This flaw can lead to confidentiality, integrity, or availability compromises for the system's data.

Sourcecodester CASAP Automated Enrollment System 1.0, a web-based enrollment platform whose backend database is exposed through the status field in the save_user.php script.

The CVSS score of 7.3 indicates high severity, while the EPSS score of less than 1% suggests low current exploitation probability. The flaw is not listed in the CISA KEV catalog. The most likely attack vector is a web-based input to the status parameter, requiring network access to the application. Exploitation would generally be straightforward for an authenticated or unauthenticated user who can submit data to the vulnerable endpoint.