A vulnerability exists in the admin/edit_expenses.php page of itsourcecode Society Management System 1.0. Manipulating the expenses_id argument triggers a SQL injection that can be performed remotely without authentication. The attack can allow an attacker to execute arbitrary SQL statements against the underlying database, potentially compromising confidentiality, integrity, or availability of the stored data. The weakness is categorized as a CWE-74 and CWE-89 type injection flaw.

Affected systems include Society Management System 1.0 published by itsourcecode. The only version explicitly mentioned is 1.0. No newer versions are listed in the provided references. The CPE string cpe:2.3:a:angeljudesuarez:society_management_system:1.0:*:*:*:*:*:*:* narrows the scope to that specific release, indicating that earlier or later versions are not known to be vulnerable without further evidence.

The CVSS score of 6.9 indicates medium severity, while the EPSS value of less than 1% suggests a low likelihood of exploitation at any given point. The vulnerability is not listed in CISA's KEV catalog, implying no documented active exploits. The attack vector is inferred to be remote since the exploit is triggered by manipulating a web request to the affected file, and any authenticated or unauthenticated user who can reach the URL could potentially exploit it if the application fails to validate or parameterize the input.