A remote SQL injection vulnerability exists in the itsourcecode Online Enrollment System 1.0. The deptid argument in /sms/grades/index.php can be manipulated to inject SQL statements. Attackers could read, modify, or delete data stored in the database, thereby compromising the confidentiality, integrity, and availability of student records. The flaw represents improper handling of user input, corresponding to weaknesses in input filtering and query composition.

The vulnerability affects the Online Enrollment System version 1.0 provided by itsourcecode. The specific affected file is the Parameter Handler component located at /sms/grades/index.php. No other versions are listed, so remediation should focus on this release.

The reported score of 6.9 signals a medium to high risk, while the probability estimate below 1% suggests exploitation is unlikely under normal circumstances. The flaw is not recorded in the national exploitation catalog, yet it can be triggered remotely through standard HTTP requests. An attacker who can reach the vulnerable endpoint could craft a deptid value that executes arbitrary SQL commands, provided no additional network or application restrictions exist.