A flaw exists in version 1.0 of itsourcecode University Management System that permits an attacker to manipulate the ID parameter in the /admin_single_student.php file, resulting in an SQL injection. The vulnerability can be exploited remotely, allowing the execution of arbitrary SQL commands against the database. This can lead to data disclosure, modification, or loss, and based on typical consequences of SQL injection it is inferred that an attacker could potentially gain lateral movement within the system.

The University Management System developed by itsourcecode, specifically version 1.0, is affected. The flaw was identified in the administration interface, targeting the single student record retrieval and manipulation feature.

The CVSS score of 6.9 indicates a moderate to high severity. Although the EPSS score is below 1%, the vulnerability has a published exploit and can be carried out remotely, raising the likelihood of real-world attacks. It is not included in the CISA Known Exploited Vulnerabilities catalog, but its exploit readiness warrants prompt attention. An attacker with network or web access to the application can drive the SQL injection by sending crafted requests to the ID parameter.