The vulnerability resides in the /otas/projects_per_department.php script of the Sourcecodester Online Thesis Archiving System v1.0. Unsanitized user input may be injected directly into SQL statements, allowing an attacker to execute arbitrary SQL queries against the application’s database. The primary impact of this flaw would be the unauthorized manipulation or disclosure of data stored in the database; this is inferred from the nature of SQL injection as the description itself does not detail specific consequences.

The affected product is Sourcecodester Online Thesis Archiving System version 1.0, a PHP‑based web application used for archiving academic theses. No vendor information beyond the generic product name is provided.

The CVSS v3.1 score of 2.7 indicates a low overall severity, and the EPSS score of less than 1% points to a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack vector is presumed to be remote through HTTP requests to the vulnerable page; the requirement of authentication is not specified, but it is inferred that manipulation could be performed without special privileges based on the file path exposed in the URL.