A flaw in the add_user_check.php script of the Raisuli student management system allows manipulation of the role argument to inject arbitrary SQL. The resulting injection can enable a remote attacker to read, modify, or delete data from the underlying database, potentially leading to full data compromise or privilege escalation. The vulnerability is present before the commit 310d950e09013d5133c6b9210aff9444382d16d1 and is documented as a remote exploitation vector.

The vulnerability affects the raisulislamg4:student_management_system_by_php application. No specific version numbers are available due to the project's rolling release model, but all releases prior to the commit mentioned are susceptible.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS score is not available. It is not listed in CISA KEV, but the exploit has been publicly disclosed, meaning attackers may already be targeting the exposed add_user_check.php endpoint. Because the attack vector is remote and the vulnerability resides in a widely deployed component, the risk of exploitation remains significant until a patch or mitigation is applied.