The vulnerability is located in itsourcecode College Management System 1.0 within the /admin/class-result.php script. The script accepts a course_code argument without adequate validation, allowing a classic SQL injection. An attacker who supplies a crafted value can execute arbitrary SQL statements against the backend database, potentially exposing, modifying, or destroying sensitive student information. This compromise affects the confidentiality, integrity, and availability of the educational platform.

The affected product is the College Management System offered by itsourcecode, identified in CPE terms as angeljudesuarez:college_management_system. The publicly available information specifies that version 1.0 is vulnerable. No later releases are listed, so administrators should confirm whether they are running this specific version and consult the vendor for any newer, patched release.

The CVSS score of 5.1 indicates a moderate severity level, and the EPSS score of less than 1% shows a very low expected probability of exploitation at present. The vulnerability is not catalogued in the CISA KEV list, which suggests limited widespread exploitation. However, an exploit is publicly available, implying that a remote attacker can initiate an attack by sending a forged HTTP request containing a malicious course_code value. The potential impact would be database compromise and data tampering.