A flaw in the /admin/edit_expenses_query.php script allows an attacker to supply a crafted detail argument that is directly inserted into a database query. This omission of input sanitization or parameterized queries permits remote SQL injection. Based on the description, the injection could be used to read from, modify, or delete data stored in the database, potentially exposing sensitive information or compromising system integrity. This statement is inferred from the nature of SQL injection rather than explicitly stated in the advisory.

The affected product is Society Management System 1.0 from itsourcecode, as listed by the CNA. No other versions are mentioned as vulnerable. Systems running this version and exposing the /admin/edit_expenses_query.php endpoint are at risk.

The CVSS score of 6.9 places the vulnerability in the medium severity range. EPSS indicates a very low exploitation probability (<1%), suggesting that in the wild the attack rate may be low. However, the advisory notes that an exploit has been publicly released, which raises operational relevance. The flaw is not yet cataloged in the CISA KEV list. Because the attack can be launched remotely and the injection payload fully controls the SQL query, the potential impact remains significant should an attacker succeed.