A flaw in the College Management System allows an attacker to inject arbitrary SQL code by manipulating the course_code field in the add-single-student-results.php page. This leads to unauthorized database queries that can reveal, modify, or delete sensitive student data. The weakness is a classic input validation defect (CWE-89) that results in a moderate risk of data breach or integrity compromise.

itsourcecode College Management System, version 1.0, as identified by the vendor. The vulnerability appears in the admin/add-single-student-results.php component, affecting all installations that use the default parameter handling logic in this file.

The CVSS score of 5.3 indicates moderate severity, and the exploit is publicly disclosed and can be triggered remotely by sending a crafted request to the vulnerable endpoint. Although EPSS data is not available and the issue is not catalogued in KEV, the lack of a patch and the availability of the exploit raise the likelihood that attackers could exploit this weakness in exposed systems. The primary vector is a remote web request, making the vulnerability relevant for any publicly accessible instance of the application.