A flaw in the ‘asign‑single‑student‑subjects.php’ file of itsourcecode College Management System allows an attacker to manipulate the course_code argument and inject arbitrary SQL. This injection can be performed remotely and is capable of exposing sensitive data, modifying database contents, and potentially retrieving credentials or other confidential information. The weakness is an uncontrolled input that returns a SQL query, enabling unauthorized read or write operations on the underlying database. The impact is confined to the database accessed by the application, but any attacker who gains this access could compromise the entire system’s data integrity and confidentiality.

The vulnerability affects the College Management System by itsourcecode, version 1.0. No other versions are listed as impacted. The associated CPE indicates that the affected product is the College Management System.

The CVSS score of 5.3 indicates a medium severity. The EPSS score of < 1% suggests that exploitation is currently considered unlikely, and the vulnerability is not listed in CISA’s KEV catalog. However, the thread notes that exploit code is publicly available, so a remote attacker could attempt to use the flaw if other mitigations are absent. The attack vector is remote via HTTP parameters, requiring network access to the admin interface. The low exploitation probability is offset by the potential damage if bypassed.