The vulnerability occurs in the index.php page of the Online Enrollment System when the view=add action processes input parameters. An attacker can supply crafted values for txtsearch, deptname, or name, causing the application to construct unsanitized SQL statements. This flaw permits arbitrary SQL injection, allowing the attacker to read, modify, or delete enrollment data stored in the database.

Affected components include the vendor itsourcecode and its Online Enrollment System version 1.0. The issue is confined to the /enrollment/index.php script that handles the add view. No other versions or modules are reported to be impacted.

The severity rating is 6.9 on the CVSS scale, representing a moderate risk. Exploit probability is low, with a score under 1%. The flaw is not cataloged in the known exploited vulnerabilities list, indicating no known active exploitation. Nevertheless, the vulnerability can be triggered remotely without authentication, so a threat assessment should consider it a moderate but relevant risk for exposed deployments.