The vulnerability exists in the file /admin/courses.php of itsourcecode College Management System 1.0. An attacker can supply a crafted value for the course_code parameter that is passed directly to an SQL statement, allowing an SQL injection to occur. This can result in unauthorized access to the database, including the ability to read, modify, or delete data stored in the system. The weakness is categorized as CWE‑74 (URL Manipulation) and CWE‑89 (SQL Injection).

The affected product is itsourcecode College Management System version 1.0. No other versions were explicitly listed as impacted in the provided information.

The CVSS score of 5.1 indicates moderate severity. The EPSS score is under 1%, suggesting low current exploitation probability. The vulnerability is not included in the CISA KEV catalog, implying it has not been identified in known exploited attacks. Based on the description, the attack vector is remote: an attacker can trigger the flaw by sending an HTTP request to /admin/courses.php with a malicious course_code value. No evidence suggests the flaw could lead to remote code execution; the impact is limited to database access.