The vulnerability resides within an undisclosed portion of /admin/edit_activity_query.php. By manipulating the Title parameter, an attacker can inject arbitrary SQL statements, a classic injection flaw classified under CWE‑74 and CWE‑89. While the vulnerability does not provide direct code‑execution capability, it enables unauthorized reading, alteration, or deletion of database contents, potentially exposing sensitive organizational data.

The flaw affects itsourcecode Society Management System version 1.0. No other product or version instances are listed.

The CVSS score of 5.3 denotes a medium severity, and the EPSS score of less than 1 % indicates a low probability of observed exploitation. It is not listed in the CISA KEV catalog, suggesting it is not yet a high‑profile or actively exploited vulnerability. The attack vector is remote, exploiting the Title input field, and the exploit code is publicly available, making the risk real for unpatched installations.