The only untrusted input, student_id, is embedded directly into SQL statements without sanitisation or parameterisation, allowing an attacker who supplies crafted input to inject arbitrary SQL. The injected SQL can read, modify or delete database records, potentially exfiltrating sensitive student information or corrupting the database. The vulnerability exists in the admin interface of the Society Management System and can be exercised remotely over the web network.

The vulnerability affects the itsourcecode Society Management System version 1.0, specifically the /admin/edit_student_query.php file. No other vendors or product versions are listed.

The CVSS score of 6.9 indicates medium severity. The EPSS score is below 1 %, showing that the real‑world exploitation probability is very low at the time of analysis. The vulnerability is not in the CISA KEV catalog, so no large‑scale known exploitation campaigns are currently reported. Nevertheless, the attack can be performed from any remote host that has network connectivity to the web server, making it an easily reachable risk once the fix has not been applied.