The vulnerability arises when the email argument in log‑in.php is used directly in an SQL statement without proper sanitization, allowing attackers to inject arbitrary SQL code. This flaw can lead to unauthorized reading of database contents, potential modification of data, and in some configurations data leakage or credential compromise. The weakness is a classic injection flaw (CWE‑74) compounded by the lack of parameterized queries (CWE‑89).

Itsourcecode College Management System version 1.0 is affected; the vulnerable file is /login/login.php.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% shows a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, and the publicly available exploit can be executed over the network by any unauthenticated user who can reach the login page. Due to the remote nature of the attack vector and the absence of additional authentication or privilege constraints, the impact spans system‑wide data confidentiality and integrity.