A function in the Student Web Portal’s profile.php file accepts a user supplied argument that is incorporated directly into an SQL query without proper sanitisation. This allows an attacker to inject malicious SQL code, potentially extracting, modifying, or deleting data stored in the database. The flaw is a classic example of CWE‑74 and CWE‑89, giving an attacker the ability to compromise the confidentiality and integrity of the portal’s data.

The vulnerability exists in version 1.0 of code‑projects Student Web Portal. The affected component is the profile.php script, which is part of the web interface that manages user profiles. Any installation of this version that exposes the profile.php endpoint to the network is vulnerable.

The CVSS score of 5.3 indicates a medium severity of the issue. The EPSS score of less than 1% suggests that the likelihood of exploitation at present is low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack is remote, can be triggered over the network, and a public exploit is available, meaning that if an unauthenticated attacker can reach the profile.php page, they could execute arbitrary SQL code against the database.