The vulnerability is a SQL injection flaw in the administrator section of College Management System 1.0. An attacker can manipulate the roll_no parameter in student‑fee.php to inject arbitrary SQL statements, allowing unauthorized reading or modification of database contents because the application executes unsanitized user input directly against the database. This weakness is classified as CWE‑89.

The flaw exists in itsourcecode College Management System version 1.0, affecting the admin/student-fee.php page. No specific patch version is available in the data, so any installation of College Management System 1.0 running that script is considered vulnerable.

The CVSS v3 base score is 5.1, indicating moderate severity. The EPSS score is below 1%, suggesting a low real‑world exploitation probability, and the issue is not listed in CISA’s KEV catalog. Attackers can reach the vulnerable parameter remotely, for example by sending a crafted HTTP request to the student‑fee.php page. If exploited, the attacker may gain read or write access to the database, potentially compromising student data, financial records, and system integrity.