The flaw resides in an undisclosed function within /admin/manage_user.php of Event Management System 1.0. When an attacker manipulates the ID argument, the application constructs an SQL query without proper sanitisation, enabling the injection of arbitrary SQL code. This can allow the attacker to read, modify, or delete data in the database, potentially exposing sensitive user information or corrupting the system state.

itsourcecode Event Management System 1.0 is affected. The vulnerability is specific to version 1.0, as identified by the vendor and its corresponding CPE.

The CVSS score of 6.9 reflects a moderate severity. EPSS indicates less than 1 percent probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless the exploit has been made public, and the attack vector appears to be remote via the ID parameter in a URL or form submission. An attacker who successfully injects SQL can potentially gain full read/write access to the database and compromise confidentiality, integrity, and availability of the system.