The vulnerability resides in the student_signup.php endpoint of the Kusalkasilva Learning-Management-System. An attacker can manipulate parameters sent to this endpoint to inject arbitrary SQL statements, potentially reading, modifying, or deleting data in the database. The flaw stems from improper handling of user input, allowing SQL injection, which is directly linked to CWE-89 and potentially CWE-74 if URL patterns are involved. The attack can be launched remotely without any local privileges, and the issue has already been publicly disclosed.

The affected product is Kusalkasilva Learning-Management-System, all releases up to the commit ffeb873f8803f1e9664384ff75000c7da45466d2. Because the project follows a rolling release model, a fixed version may exist beyond that point, but specific patched versions are not listed. Any deployment using older or current unpatched copies remains vulnerable.

The CVSS score of 6.9 indicates a moderate risk level, while an EPSS score is not available. However, the public disclosure of the exploit and absence of a KEV listing suggest that exploitation may already be occurring in the wild. With remote access and lack of authentication guarding the endpoint, the potential impact is significant. The exploitation path is straightforward: craft a malicious payload for the student_signup.php input fields, obtain execution of arbitrary SQL, and manipulate the database.