A vulnerability in the Online Enrollment System allows attackers to inject arbitrary SQL by supplying a malicious value for the Name parameter in the page /sms/user/index.php?view=add. This flaw is a classic SQL injection that can grant an attacker unauthorized read or write access to the underlying database. The flaw is tied to the Parameter Handler component and is enumerated as CWE-74 (Improper Handling of Parameters) and CWE-89 (SQL Injection).

The affected application is itsourcecode’s Online Enrollment System, version 1.0. No other versions are specifically listed as vulnerable.

The vulnerability scores a CVSS 6.9, indicating moderate severity. Its EPSS score is not available, but the flaw is publicly known and the exploit code has been made available online, suggesting that attackers could obtain it easily. It is not listed in the CISA KEV catalog, implying it has not yet been seen in large‑scale exploitation. The attack vector appears to be remote over the web, and successful exploitation would require only an authenticated or unauthenticated user to supply an injected payload via the Name field, potentially leading to data exposure or compromise of application integrity. Given the moderate score and public availability of the exploit, the risk to systems running this version is considered significant but not critical.