A flaw in the CollegeManagementSystem’s fetch.php file allows an attacker to manipulate the department_code parameter, resulting in an unsanitized SQL query. This flaw corresponds to CWE‑74 and CWE‑89 and can enable an unauthenticated remote attacker to read or alter sensitive database contents. Based on the description, the attack vector is remote and a public exploit is available, meaning the vulnerability can be triggered from outside the network without prior credentials.

The vulnerable code resides in the tittuvarghese CollegeManagementSystem repository at the dashboard_page/forms/fetch.php path. No specific version information is provided; continuous‑delivery practices imply the issue exists in all current releases. The affected product is identified by the vendor tittuvarghese:CollegeManagementSystem.

The CVSS score of 6.9 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the exploit is publicly known and the endpoint is reachable remotely, the risk remains elevated until a patch or effective mitigation is applied. The attacker does not need prior authentication to exploit the flaw, making it readily usable against exposed deployments.