The vulnerability resides in the admin/index.php file of itsourcecode Event Management System 1.0, where the ID parameter is not properly validated, allowing an attacker to inject arbitrary SQL code. By manipulating this argument an attacker can read, modify, or delete data in the underlying database, potentially exposing confidential information and altering the integrity of the application. This flaw can compromise the confidentiality and integrity of the system’s data store.

Vendor itsourcecode offers the Event Management System product, version 1.0, which is affected by this issue. Users running this specific version should consider it vulnerable until a fix is applied.

The CVSS score of 6.9 indicates medium severity, and the EPSS score of less than 1% suggests a low current exploitation probability, yet the vulnerability is publicly reported and can be exploited remotely via a standard web request to /admin/index.php. It is not listed in the CISA KEV catalog, but the ability to inject SQL remotely poses a significant risk to any exposed database and could be a stepping stone to further attacks if additional credentials or lateral movement capabilities are available.