A flaw in the Search module of PHPGurukul Directory Management System allows a malicious actor to insert arbitrary SQL statements through the searchdata parameter in /index.php. The injected SQL can expose, alter, or delete database contents, potentially allowing unauthorized access to sensitive user data or modification of system records. The flaw does not directly grant code execution, but the ability to manipulate data can lead to significant business impact and credential misuse.

The vulnerability affects PHPGurukul Directory Management System version 1.0. The exposed code resides in the Search component of the index.php file. No other product versions are listed as affected.

The CVSS score of 6.9 reflects a moderate to high severity, and the EPSS score of < 1% indicates a low probability of exploitation at present. The flaw is not listed in the known exploited vulnerabilities catalog, but the attack can be triggered remotely via HTTP requests to the vulnerable endpoint. Because the public exploit has been disclosed, an attacker could craft a payload to retrieve or tamper with data if the vulnerable system is exposed to the internet.