A SQL injection flaw exists within the accounts.php file of the Online Student Management System’s Login component. By supplying crafted input in the username or password fields, an attacker can inject arbitrary SQL statements, potentially manipulating or extracting sensitive database information. The weakness arises from improper input validation (CWE‑74) combined with failure to use parameterized queries (CWE‑89), enabling unauthorized data access.

The vulnerability affects code‑projects Online Student Management System version 1.0. No other product versions are listed by the CNA; deployments of this exact application version are therefore susceptible.

The CVSS score of 6.9 indicates a moderate severity, while the EPSS score of less than 1% reflects a very low likelihood of exploitation in the wild. The flaw is not identified in the CISA KEV list, but it has been publicly disclosed and can be triggered remotely through the login interface. An attacker only needs the ability to submit a username/password pair, which is typically available without prior authentication, making the attack surface relatively open.