The vulnerability is a SQL injection flaw in the User Profile Update Handler of SourceCodester Simple E-learning System 1.0, triggered by manipulating the firstName field. This flaw can enable a remote attacker to inject arbitrary SQL statements into database queries, potentially reading, modifying, or deleting sensitive data. The weakness corresponds to CWE-74 and CWE-89.

Affected systems include SourceCodester Simple E-learning System version 1.0, deployed by institutions or individuals hosting the platform. The vulnerability resides in the user profile update function and is not limited to a specific operating environment; any installation that uses the default code base is susceptible

The CVSS base score of 5.3 indicates moderate severity; the lack of an EPSS score or KEV listing suggests limited data but the exploit is publicly available. Attackers can reach the vulnerable endpoint remotely through the web interface by sending crafted firstName values. Because the flaw is an injection point in user-supplied data, no local privileges or complex setup are required. The public nature of the exploit means that organizations should assess exposure promptly.