A flaw in itsourcecode Directory Management System version 1.0 allows an attacker to craft an email address that is not properly sanitized in the /admin/forget-password.php page. The inadequately validated input leads to a classic SQL injection, enabling data extraction or modification, which can compromise the confidentiality and integrity of user accounts. This weakness is categorized as CWE‑89 (SQL Injection) and CWE‑74 (SQL Injection via Predicted or Constructed Input).

The affected product is itsourcecode Directory Management System, version 1.0. Affected components include the /admin/forget-password.php functionality, which processes user-supplied email addresses for password recovery requests.

The vulnerability carries a CVSS score of 6.9, indicating a moderate severity. The EPSS score is reported as less than 1 percent, implying a low likelihood of exploitation given current public knowledge and reported activity. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is remote, as the input can be supplied over the network by any user with access to the admin interface, and the exploit has been made public. Proper controls, such as patching, input validation, and access restrictions, are essential to mitigate potential exploitation.