The vulnerability is an input validation flaw that allows attackers to inject arbitrary SQL code through the username and password fields in the loginCheckTest.php script. This flaw is categorized as CWE‑74 (Improper Input Validation) and CWE‑89 (SQL Injection), allowing an attacker to bypass authentication, read sensitive data, or modify the database. The CVSS score of 6.9 reveals a moderate severity and indicates that the flaw can lead to confidentiality and integrity compromise.

The affected product is the Student‑Management‑System developed by imranrisal‑dev. No versioning information is available; the repository hash is provided, but the vendor did not publish patch notes, so it is unclear which commits contain the flaw or its fix. Administrators should assume that any instance of the loginCheckTest.php component is vulnerable until a verified patch is applied or the source code is audited.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the public nature of the exploit and the ability to launch it remotely from the internet mean that the risk remains significant. Attackers who can reach the login interface can execute the injected SQL and potentially steal tables, exfiltrate personal data, or pivot to other services. In the absence of an official fix, defensive measures such as limiting network exposure, input validation, and database‑level permissions are essential.