A vulnerability exists in a function of delete.php within the Student Management System that allows an attacker to manipulate the user_id, course_id, teacher_id, student_id, or application_id parameters. This manipulation results in an untrusted input being incorporated into an SQL query without proper sanitization, enabling SQL injection (CWE-89). The impact of successfully exploiting this flaw is the ability to read, modify, or delete data in the underlying database, potentially exposing sensitive student or teacher information. The vulnerability is classified as a medium severity flaw (CVSS 6.9).

The affected product is raisulislamg4’s Student Management System written in PHP. No specific release numbers are provided because the project follows a rolling‑release model. All versions built up to the commit identified by 310d950e09013d5133c6b9210aff9444382d16d1 are potentially vulnerable until a patch is released.

The flaw can be exploited remotely through the delete.php endpoint by crafting malicious query parameters. Publicly available exploits suggest that attackers can achieve this attack vector without special privileges. Although the EPSS score is not available, the existence of a published exploit and the CVSS score of 6.9 indicate a moderate to high risk of exploitation, especially for organizations that do not restrict access to the endpoint.