This vulnerability allows an attacker to inject SQL code through the activity_id parameter in the delete_activity.php script of itsourcecode Society Management System 1.0. The injected payload can manipulate or read the database, potentially compromising the confidentiality and integrity of stored data. The flaw is an instance of input validation failure (CWE-74) and classic SQL injection (CWE-89).

The affected product is itsourcecode: Society Management System, version 1.0, running on servers that expose the delete_activity.php endpoint to remote users. No other product versions have been reported as affected.

The CVSS score of 6.9 labels the exploit as moderate severity. The EPSS score of less than 1 % indicates a very low probability of current exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can reach the vulnerable parameter remotely over HTTP or HTTPS. Once compromised, an attacker can manipulate query execution to modify, delete, or retrieve sensitive records, although the description does not specify authentication requirements. The overall risk remains moderate, but the potential impact on data integrity warrants precautionary action.