An unknown function in the admin/edit_activity.php script accepts an activity_id parameter that is not properly sanitized. By manipulating this argument, an attacker can inject arbitrary SQL statements, allowing unauthorized reading, modification, or deletion of database records. The flaw directly compromises data confidentiality and integrity.

The vulnerability affects itsourcecode Society Management System version 1.0, as identified by the vendor itsourcecode in the product name. The affected code resides in the admin component and is accessible at /admin/edit_activity.php. No other versions are explicitly listed as vulnerable.

With a CVSS score of 6.9 the flaw sits in the medium severity range, while the EPSS score of less than 1 % indicates a low probability of exploitation at present. Nonetheless, the vulnerability is exploitable remotely and a public exploit is available. The flaw is not currently listed in the CISA KEV catalog, but the existence of a publicly known exploit warrants a timely response.