Sourcecodester Online Thesis Archiving System 1.0 contains a SQL injection flaw in the file /otas/admin/curriculum/manage_curriculum.php. The flaw allows an attacker to embed arbitrary SQL code into the input fields of the curriculum management form, which is then executed directly against the underlying database. This type of weakness, classified as CWE-89, can lead to leaking confidential thesis records, modifying or deleting data, and potentially compromising the integrity of the entire archive.

The vulnerability is limited to the Sourcecodester Online Thesis Archiving System version 1.0, specifically the administrative page that handles curriculum data. No other vendors or product versions are listed in the official record. The flaw exists only in the manage_curriculum.php script exposed to administrative users.

The CVSS score of 2.7 and an EPSS score below 1% indicate that the risk and likelihood of exploitation are relatively low. The vulnerability is not part of the CISA KEV catalog. Exploitation would require access to the vulnerable admin page, which may demand authenticated admin credentials or direct web server reach. If successful, the attacker could execute arbitrary SQL statements, potentially gaining full read or modification capabilities over the thesis database.