A SQL injection flaw in the phpGurukul Online Course Registration System allows a remote attacker to manipulate the "id" or "cid" parameters in the manage-students.php page, enabling the injection of arbitrary SQL statements. This can compromise database integrity, reveal sensitive student information, and potentially allow the attacker to modify or delete data. The weakness maps to CWE-74 and CWE-89.

The vulnerability is present in all releases of PHPGurukul’s Online Course Registration System up to and including version 3.1. Versions released after 3.1 do not contain this flaw unless the same vulnerable code remains in manage‑students.php.

CVSS base score 5.3 indicates moderate impact; the EPSS score is below 1%, suggesting a low current exploitation probability. The vulnerability is not yet listed in the CISA KEV catalog, but it is publicly disclosed, and the remote attack vector means anyone able to send HTTP requests can exploit it. The lack of an available patch reduces protection, so administrators should prioritize updating or hardening the affected endpoint promptly.