A flaw in the University Management System allows an attacker to inject arbitrary SQL code via the ID argument in the /admin_single_student_update.php page. This vulnerability falls under CWE-74 (Input Validation) and CWE-89 (SQL Injection). If exploited, an attacker could read, modify, or delete data in the database, potentially leading to data exfiltration, integrity loss, or denial of service. The statement that an attacker could read, modify, or delete data is inferred from the description, as it is not explicitly stated in the CVE text.

The vulnerability is limited to the University Management System provided by itsourcecode, version 1.0. Users running this software should validate that they are running the affected build.

The CVSS score is 6.9, indicating a moderate severity. EPSS is below 1%, suggesting exploitation is unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the issue by sending a crafted request to the web application’s admin interface, and because the attack is remote, any user with network access to the application could potentially exploit it. The inference that attackers can trigger the issue via a crafted remote request to the admin interface follows from the mention of remote exploitation in the CVE description.