The flaw exists in School Management System 1.0 within the student index module, where manipulating the ID parameter permits an attacker to inject SQL statements. This leads to unauthenticated read or write access to the underlying database, potentially exposing sensitive student information and allowing malicious alterations to records. The vulnerability is categorized as a classic SQL Injection (CWE‑89) combined with improper input handling (CWE‑74).

This issue affects any installation of itsourcecode School Management System version 1.0. The vulnerability resides in the /student/index.php file, and no other versions or modules are indicated as affected.

The CVSS score of 6.9 reflects a medium severity impact, while the EPSS score of less than 1% suggests a low likelihood of active exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, indicating no widespread public exploit activity is documented as of now. An attacker can remotely exploit the flaw by sending crafted requests to the ID parameter, provided the application is reachable over the network. No special privileges are required, and the exploit can be performed from any internet‑connected machine without authentication.