The vulnerability is in the admin/save_student.php file of the cak-filemanagement-system. User‑supplied parameters such as date, department, subject, forwarded_to, action_taken_by, section, and password are passed directly to mysqli_query without any sanitization, creating a classic SQL injection (CWE‑74, CWE‑89). An attacker can inject arbitrary SQL commands, potentially reading, modifying or deleting data in the backend database. The exploit can be triggered remotely via HTTP requests, giving an adversary the ability to compromise sensitive information handled by the system.

Affected versions of the cak-filemanagement-system include all releases up to and including the commit 5e6433246475e66462e1fea980688de96a049297. Any deployment of the system that has not been updated to a newer release remains vulnerable to this injection flaw.

The CVSS score of 6.9 indicates a moderate severity; however, the exploit is publicly available and can be performed remotely by sending crafted requests to the admin/save_student.php endpoint. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the exact probability of exploitation remains uncertain, but the presence of a ready‑to‑use exploit suggests that competent attackers could leverage the flaw in the wild. In environments where the admin interface is exposed to untrusted networks, the likelihood of a successful compromise is significant, elevating the practical risk to high.