The Online Student Enrollment System v1.0 contains an unsanitized SQL query in newCourse.php that accepts user-provided input via the 'coursename' parameter. This flaw allows an attacker to inject arbitrary SQL statements, potentially extracting confidential enrollment data, modifying records, or in worst cases executing commands that could compromise the underlying database. The vulnerability maps to CWE‑89 and carries a CVSS score of 9.8, reflecting a high impact and ease of exploitation.

The affected product is the Online Student Enrollment System by itsourcecode, version 1.0. No other versions or vendor variants are listed, so the risk is confined to installations of this specific release.

With an EPSS score below 1% and not yet in the CISA KEV catalog, widespread exploitation is currently unlikely. Nevertheless, the flaw can be triggered remotely by sending a crafted HTTP request to newCourse.php. Once the 'coursename' field is exploited, an attacker can read, alter, delete, or insert data in the database, leading to confidentiality, integrity, and availability issues.