A flaw exists in the PHPGurukul Online Course Registration System in the file /enroll.php that allows an attacker to manipulate the request arguments—studentregno, Pincode, session, department, level, course, and sem—to inject arbitrary SQL statements. The injection can be triggered remotely by sending a crafted HTTP request to the vulnerable endpoint. Once exploited, the attacker can read, modify, or delete database records, potentially exposing sensitive student information or compromising the integrity of the registration system.

The vulnerability affects PHPGurukul’s Online Course Registration System versions up to and including 3.1. No later versions are mentioned as receiving the fix. System administrators should verify whether their deployment is within the affected release range.

With a CVSS score of 5.3, this issue falls into the medium severity range. The EPSS score is below 1 % indicating a low probability of exploitation under current data. The vulnerability is not listed in the CISA KEV catalog. Although the attack vector is remote, it requires only that the attacker is able to send HTTP requests to the vulnerable server, making the exposure significant for publicly reachable installations. Successful injection could lead to data leakage or unauthorized data manipulation.