An attacker can manipulate the searchteacher argument in the Teacher Record System’s Parameter Handler. This insufficiently sanitized input allows arbitrary SQL statements to be executed against the database. The vulnerability enables remote SQL injection, potentially exposing sensitive student records or allowing unauthorized modification of data. The weakness is a classic input validation flaw, aligned with CWE-74 and CWE-89.

The affected product is SourceCodester’s Teacher Record System version 1.0. No other versions are listed as vulnerable. This version is known to use the Parameter Handler component that processes the searchteacher variable, leading to the injection flaw. Impacted users should verify whether they run exactly 1.0 or later releases, as patching newer versions may eliminate the flaw.

The CVSS score of 6.9 indicates a moderate severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The publicly available exploit demonstrates that the flaw can be triggered remotely, likely via a crafted HTTP request containing a malicious searchteacher parameter. Given the lack of a CVE-kev listing and the moderate score, the risk remains significant for systems that still run the vulnerable version, especially if they expose the Teacher Record System to the internet. The vulnerability can be exploited without requiring authentication, making it a high‑threat scenario for unprotected deployments.