A vulnerability was identified in the itsourcecode Fees Management System version 1.0 affecting the /manage_user.php script. By manipulating the ID argument, an attacker can inject arbitrary SQL statements, leading to unauthorized data exposure, modification, or deletion. The weakness stems from insufficient input validation, corresponding to CWE‑74 (Injection of unintended operators) and CWE‑89 (Improper Neutralization of Special Elements used in a SQL context). The flaw enables remote exploitation through the web interface.

The vulnerability exists in itsourcecode's Fees Management System, specifically in the manage_user.php component of version 1.0. No other versions or components are listed as affected, and the vendor is itsourcecode. The product is accessed via the web, so the attack surface is the web server hosting the application.

With a CVSS base score of 5.3, the impact is considered moderate. The EPSS score is not provided, but the CVE notes that a public exploit has been released, indicating the potential for real‑world attacks. The vulnerability is not yet flagged in CISA's KEV catalog. Exploitation requires only remote access to the web interface and does not require local privilege escalation. Given the moderate severity and the availability of public exploits, administrators should treat this as a significant risk that could lead to data compromise if left unmitigated.