A flaw in the login endpoint of the Online Application System for Admission allows injection of arbitrary SQL through an unchecked user input. The vulnerability arises from an unknown functionality in enrollment/index.php that fails to properly sanitize or parameterize the input, enabling an attacker to execute arbitrary SQL statements. If successfully exploited, a remote attacker could read sensitive data, modify or delete records, and possibly gain further access to the underlying system depending on the database permissions length.

The affected product is the Online Application System for Admission by code‑projects, version 1.0. The vulnerability is located in the login endpoint "enrollment/index.php" and is specific to this release without a known mitigated version yet available.

TheSS score of 6.9 rates the vulnerability as high‑medium severity, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild at present, though the issue has been publicly disclosed. The attack can be launched remotely using the login functionality, and there is no information that the vulnerability is listed in the CISA KEV catalog. Exploitation requires only the ability to send crafted input to the login endpoint, making it an easy target for automated scanners.