A remote attacker can exploit a SQL injection flaw in the Kusalkasilva Learning-Management-System’s admin login module. By manipulating the username or password fields, an attacker can inject arbitrary SQL commands into the mysql_query call, potentially exposing or altering application data. The vulnerability is not limited to local interfaces; it can be triggered over the network, making it readily exploitable from external hosts. The impact is primarily data confidentiality and integrity compromise, and may allow attackers to elevate privileges within the administrative backend.

The affected product is the Kusalkasilva Learning-Management-System, in all releases up to commit ffeb873f8803f1e9664384ff75000c7da45466d2. Because the project does not use versioning, all installed instances of this LMS are potentially vulnerable unless confirmed patched.

With a CVSS score of 6.9, this vulnerability is considered moderate. The EPSS score is not available, but the exploit has been published and the issue remains unresolved. The vulnerability is not listed in CISA’s KEV catalog. Attackers can launch the exploit remotely, targeting the login.php endpoint without needing prior authentication. The lack of a vendor patch and absence of an official workaround increase the risk to organizations that rely on this system.