The vulnerability is an insecure handling of the expenses_id parameter in the delete_expenses.php script of itsourcecode's Society Management System. Attackers can craft a request that injects arbitrary SQL commands into the database query. This flaw does not require local or privileged access; the attack can be launched remotely from any machine that can reach the web application. The ability to execute arbitrary SQL statements can lead to unauthorized data exposure, tampering, or deletion of financial records kept by the system.

The exploit targets the Society Management System version 1.0 developed by itsourcecode. The vulnerability exists in the delete_expenses.php endpoint, which is accessible to any user who can send requests to the application. No other products or versions are listed as affected at this time.

The vulnerability has a CVSS score of 6.9 and an EPSS score of less than 1%, indicating low prevalence but a possible exploit discovery. It is not listed in CISA’s KEV catalog, but the exploit has been published and can be used remotely. Attackers can leverage the flaw by sending a crafted expenses_id value through GET or POST, triggering an injection that may reveal or alter sensitive expense data. The impact encompasses unauthorized data access and potential manipulation of the system’s financial records.