A SQL injection flaw exists in the Kusalkasilva Learning-Management-System's search_class.php file, specifically through manipulation of the school_year argument. The vulnerability allows an attacker to inject arbitrary SQL code, which can compromise the confidentiality and integrity of the underlying database, potentially exposing sensitive student data or altering coursework records. This weakness is represented by CWE-74 (Improper Parsing) and CWE-89 (SQL Injection).

The issue affects the Kusalkasilva Learning-Management-System, any instance running a version prior to commit ffeb873f8803f1e9664384ff75000c7da45466d2. No formal version numbers are available because the project uses a rolling release model, and the fix has not yet been published or released.

With a CVSS score of 5.3, the vulnerability is considered medium severity, but the publicly available exploit indicates that it could be used without significant barriers. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via an HTTP request to search_class.php, and an attacker could manipulate the school_year parameter to insert malicious SQL. The overall risk is moderate, warranting timely remediation.