A flaw exists in the delete_user.php script of the code‑projects Student Membership System version 1.0. An attacker can manipulate the ID parameter to inject arbitrary SQL commands, enabling unauthorized data extraction, modification, or removal of user records. The weakness arises from insufficient input validation, a classic SQL injection scenario matched to CWE‑74 and CWE‑89.

The vulnerability affects the Student Membership System 1.0, specifically the delete_user.php component accessed through the web interface. Any installation of this application that hosts that script is at risk.

The base CVSS score of 5.3 indicates moderate severity. The flaw can be exploited remotely by sending a crafted ID value to the delete_user.php endpoint. A publicly available exploit demonstrates that the attack is achievable without additional credentials. No exploitation probability metric is provided, and the vulnerability has not been reported as a widely deployed exploit in known catalogs.