An attacker can manipulate the ID parameter in view_department.php to execute arbitrary SQL statements. The vulnerability allows a remote attacker to inject SQL commands, enabling unauthorized data disclosure, modification, or destruction. The description attributes the flaw to CWE-74 (Parameter Manipulation) and CWE-89 (SQL Injection). The publicly available exploit demonstrates that the flaw can be used to compromise confidentiality and integrity of the database.

SourceCodester Simple Student Information System is affected. No specific version information is provided, so all deployments of this product are potentially vulnerable until a patch is applied.

The CVSS score of 6.9 indicates a medium severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, as the exploit requires only a web request. Because the flaw resides in an exposed PHP file and can be triggered by modifying a URL parameter, an attacker with network access to the web server could launch it without additional privileges. The exploit is publicly available, increasing the likelihood that it may be used in the wild.