The vulnerability is a classic SQL injection in the admin_search_student.php module of the University Management System 1.0, allowing a remote attacker to manipulate the admin_search_student parameter. This flaw is a CWE‑74/CWE‑89 weakness that can be abused for arbitrary SQL execution. The attack vector is remote and can be triggered by sending crafted HTTP requests that include malicious input.

Affected are the University Management System released by itsourcecode, version 1.0, which contains the vulnerable admin_search_student.php script. No other product versions are listed as affected.

The CVSS base score is 6.9, indicating moderate severity. The EPSS score of less than 1% points to an extremely low likelihood of exploitation in the wild, and the vulnerability has not been catalogued in CISA’s KEV list. Attackers can trigger the issue remotely by sending crafted HTTP requests containing malicious values for the admin_search_student parameter, potentially from a web browser or automated script. Successful exploitation would require the application to be reachable and its input handling to be unprotected, thereby exposing the database to unauthorized queries.