The vulnerability resides in the login.php process of itsourcecode's Online Enrollment System, where an unsanitized user_email argument is incorporated directly into SQL statements. This enables a remote attacker to inject malicious SQL, potentially reading, modifying, or deleting data, and thereby compromising confidentiality, integrity, and availability of the enrollment database.

The affected product is itsourcecode Online Enrollment System version 1.0, specifically the /sms/login.php endpoint. Users deploying this version should verify whether their installation includes this processing mechanism.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, but it remains publicly exploitable. Attackers can carry out the exploitation remotely by sending a crafted request to the login page. Without a vendor patch, the risk persists for any system that remains on this vulnerable version.