This vulnerability is a classic SQL injection that allows an attacker to manipulate the Username parameter in login_check.php. The injected payload can be delivered remotely, giving the attacker the ability to bypass authentication or extract arbitrary data from the database. The flaw arises from improper input validation (CWE-74) and unsanitized queries (CWE-89), allowing direct execution of malicious SQL statements.

The affected product is the open‑source Student Management System provided by raisulislamg4. No specific version numbers are available because the project uses a rolling release model. The vulnerability applies to any deployment that has not yet incorporated the fix.

The CVSS base score is 6.9, indicating high impact. The EPSS score is not reported. The flaw is publicly disclosed and not listed in the CISA KEV catalog. Because the attack can be launched over the network and the injection payload is straightforward, the overall likelihood of exploitation remains moderate to high for exposed systems.