The flaw resides in an unnamed function in archive2.php: the sy argument is inserted directly into SQL statements, allowing maliciously crafted input to alter the query. This vulnerability is a classic SQL injection that can be exploited remotely to read, modify or delete data from the database, potentially compromising the confidentiality and integrity of the system's information. The reported CWE identifiers confirm that the issue stems from unvalidated input being used in a database context.

SourceCodester Class and Exam Timetabling System version 1.0, the sole affected product listed in the CNA data. No other versions are mentioned, so any deployment of this exact release is considered vulnerable.

The CVSS score of 6.9 indicates a medium to high severity. The EPSS score is not reported, and the vulnerability is not present in CISA KEV catalog, which suggests that while the flaw is known, widespread exploitation has not been observed yet. Nonetheless, the attack vector is remote and the vulnerability is publicly disclosed, meaning a determined attacker could offer a simple payload to gain unauthorized database access. Proper access controls and database isolation would mitigate the potential damage but do not eliminate the flaw.