The issue resides in an unidentified function of /dipam/check-user.php of the Campcodes Division Regional Athletic Meet Game Result Matrix System, where manipulation of the argument abbr triggers an SQL injection flaw. This flaw permits an attacker to inject arbitrary SQL statements into the database query, potentially allowing unauthorized reading of user data, modification of stored scores, or even deletion of records. The vulnerability is exploitable remotely and an exploit is publicly available, so the risk of compromise is significant for any deployment that exposes this endpoint to users.

The vulnerability exists in Campcodes Division Regional Athletic Meet Game Result Matrix System versions up to and including 2.1. No other versions are currently identified as affected.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is not available; the vulnerability is not listed in CISA KEV. The attack vector is remote, relying on HTTP requests that include a crafted abbr parameter. With a public exploit available, the likelihood of exploitation remains high for systems that still run the vulnerable version and expose the check-user.php endpoint.