The register1.php script improperly validates the fname parameter, which allows an attacker to inject arbitrary SQL statements. If the injection succeeds, the attacker can read sensitive data, modify or delete records, and otherwise tamper with the admission system database. This flaw is a classic SQL injection, identified as CWE-74 and CWE-89.

Itsourcecode Online Admission System version 1.0 is identified as vulnerable. No other versions are explicitly listed in the provided data, so the vulnerability status of later releases is unknown; customers using version 1.0 should verify whether they have applied the fix, and for other versions, the vendor should be consulted for advisories.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the publicly available exploit and remote attack vector mean that an attacker could realistically abuse the flaw. The risk is moderate, and timely remediation is recommended.