A vulnerable path in the enrollment/index.php page of itsourcecode School Management System 1.0 allows the manipulation of an ID argument to inject SQL statements. The flaw arises from inadequate input validation and results in remote execution of arbitrary database commands, granting an attacker read, modify, or delete access to the underlying database. The impact is thus a potential loss of confidentiality, integrity, and availability of the system’s data.

The affected product is itsourcecode School Management System, version 1.0. No other versions are listed as affected, and the vulnerability is linked to the /enrollment/index.php handling of an ID parameter.

The CVSS score is 6.9, indicating a high impact and medium complexity. The EPSS score is less than 1 %, reflecting a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The threat vector is remote, as the injection can be triggered from outside the site without additional privileges. Attackers could exploit this flaw to extract or corrupt sensitive information stored in the database.