A weakness in the admin functionality of itsourcecode Society Management System 1.0 allows attackers to inject arbitrary SQL through the student_id parameter in check_studid.php. Because the input is not properly validated or escaped, it can be embedded directly in database queries, potentially enabling data disclosure, modification, or deletion. The exploit can be launched remotely, meaning an attacker does not need local access to the server, and attack code has been made publicly available.

Society Management System version 1.0 by itsourcecode, specifically the /admin/check_studid.php endpoint handling the student_id argument. No other product versions or vendors are documented as affected.

The CVSS score of 6.9 places the vulnerability in the moderate severity range, while the EPSS score of less than 1% indicates a low current probability of exploitation. Although the vulnerability is not listed in the CISA KEV catalog, the combination of a remote attack vector and publicly available exploit code raises the risk for organizations that expose the /admin area to the internet. An attacker exploiting this flaw could gain read or write access to the database, compromising confidentiality, integrity, and potentially availability of the system.