The vulnerability is a classic SQL injection flaw residing in the receipt.php script of itsourcecode Fees Management System. Manipulating the ef_id argument allows an attacker to inject arbitrary SQL statements, potentially exposing sensitive data, altering records, or creating a foothold for further compromise. This weakness is mapped to CWE-74 and CWE-89, indicating improper input handling for database queries.

Affected are users of itsourcecode Fees Management System version 1.0. The flaw exists in the receipt.php functionality and impacts any deployment that accepts the ef_id parameter without proper sanitization.

The CVSS score of 5.3 indicates moderate severity, yet the vulnerability can be triggered from remote sources, as documented in the public exploit reports. EPSS information is not available, and the issue is not cataloged in CISA KEV. Attackers would need network access to the web server; no local privilege escalation is required. Given the lack of critical safeguards, the risk is non‑negligible, particularly in environments that expose the system to the internet.