A flaw in the SourceCodester Online Admission System allows an attacker to inject arbitrary SQL code through the program parameter in programmes.php. The vulnerability is a classic SQL injection (CWE-74, CWE-89). Successful exploitation can lead to unauthorized read or modification of the database, potentially exposing sensitive student data or altering admission records.

The affected product is SourceCodester Online Admission System version 1.0. No other versions were mentioned. Users running this specific version are at risk.

The CVSS score of 6.9 indicates moderate severity. The ability to launch the exploit remotely, without requiring authentication, raises the likelihood of exploitation. Although EPSS data is not available and the vulnerability is not listed in CISA's KEV catalog, the publicly available exploit and the absence of mitigations suggest a high practical risk for systems that have not applied a patch or other defensive measures.