The vulnerability exists in the Student Details Management System version 1.0, specifically within the /index.php file that processes the roll query string. By manipulating the roll argument, an attacker can inject arbitrary SQL statements, giving them the ability to read, modify, or delete database records. This flaw is a classic example of CWE‑89 (SQL Injection) and CWE‑74 (Unvalidated Hyperlink or HTML References), indicating insufficient input validation and lack of parameterized queries.

The affected product is code-projects' Student Details Management System 1.0. No other vendors, products, or versions are listed as impacted, so risk is confined to installations of this exact version that expose the vulnerable /index.php endpoint.

The CVSS Base Score of 6.9 classifies this as a moderate severity vulnerability. EPSS information is not available, and the flaw is not listed in the CISA KEV catalog. However, the exploit is publicly available and can be triggered remotely without authentication by crafting a specially‑formatted URL containing the roll parameter with SQL payloads. The public nature of the exploit raises the likelihood of real‑world attacks that could compromise confidentiality and integrity of student data.