The vulnerability is a classic SQL injection in the Username parameter of /admin/index.php. Because the input is concatenated directly into SQL queries, an attacker can inject arbitrary SQL statements. This flaw falls under CWE-74 and CWE-89. Successful exploitation would allow a remote attacker to read, modify, or delete sensitive data stored in the database, potentially compromising confidentiality, integrity, and availability of the application.

The affected product is itsourcecode Directory Management System version 1.0. It is hosted on a web server running the file /admin/index.php. The CVE affects only this particular version; no other versions are listed as vulnerable.

The CVSS score is 6.9, indicating a moderate severity. The EPSS score is less than 1 %, meaning the probability of exploitation in the wild is currently very low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the flaw is exploitable over the network and an attacker can trigger the injection remotely. While no active exploit is reported, the public disclosure and available proof‑of‑concept code increase the likelihood that malicious actors could develop or reuse an exploit.