A vulnerability in the EditPolicyHolder.php component of dhikshitha29’s Insurance-Management-System allows an attacker to inject arbitrary SQL through the Policy_no and Name input fields. The flaw resides in a direct mysqli_query call that accepts unsanitized user data, enabling execution of crafted queries that can read, modify, or delete sensitive policy information. The impact is a loss of confidentiality and integrity of the database and potentially provides an attacker with elevated privileges if the database user is sufficiently privileged. The CVSS score of 6.9 reflects the moderate severity of this SQL injection risk.

The vulnerability affects all instances of the Insurance-Management-System distributed under the dhikshitha29 brand. No specific release hash or version number is identified as fixed; the project follows a rolling release model, so affected deployments may include any recent commit prior to a patch that has not yet been published.

Because the flaw can be triggered remotely and an exploit has already been publicly released, the likelihood of exploitation is considerable even though the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog, yet the combination of remote access, SQL injection, and public availability of an exploit suggests a moderate to high operational risk for organizations running an unpatched version of the system.