A SQL injection vulnerability exists in the index.php file of itsourcecode Student Management System 1.0. By manipulating the ID parameter, an attacker can inject arbitrary SQL, allowing unauthorized database queries or modifications. This flaw is based on improper input validation (CWE-74) and unsanitized SQL construction (CWE-89). The attack can lead to confidentiality, integrity, and availability impacts, including data exfiltration, data corruption, or full compromise of the database.

The affected product is itsourcecode Student Management System version 1.0, deployed on the /ramonsys/billing/index.php path. The issue is limited to this version, and any environment running this codebase is vulnerable. Users running this software should verify that they are on the affected version and plan for remediation.

The CVSS score of 6.9 indicates a moderate severity vulnerability. The EPSS score is below 1%, suggesting that the likelihood of exploitation in the wild is low, but the vulnerability is publicly available and remote, meaning an attacker can trigger it from outside the network. The vulnerability is not listed in the CISA KEV catalog. An attacker who can send crafted requests to the ID parameter can exploit the injection without authentication, making the risk significant for exposed deployments.