A flaw exists in the SourceCodester Online Class Record System 1.0 within the /admin/subject/controller.php file. An attacker can manipulate the ID argument supplied to the script, causing the application to embed unsanitized input directly into a SQL statement. This lets the attacker execute arbitrary SQL commands against the underlying database, potentially exposing, modifying, or deleting sensitive data. The vulnerability is exploitable over the network, meaning an unauthenticated remote user can trigger it through legitimate HTTP requests using a crafted ID parameter, a likely attack vector inferred from the description.

This vulnerability affects the SourceCodester Online Class Record System product version 1.0, as distributed by SourceCodester. No other versions or vendors are currently listed as affected. A public demonstration of the flaw exists for this specific version.

The CVSS base score is 6.9, indicating a high severity. EPSS indicates a very low likelihood of exploitation, but the vulnerability is known to have a public exploit and is reachable remotely without authentication. The flaw is not in CISA's KEV catalog. Attackers with the ability to send HTTP requests to the /admin/subject/controller.php endpoint can elevate their privileges within the database. Due to the low exploitation probability, the risk is moderate but the potential impact of data exposure or loss remains significant.