A flaw in the admsnform.php endpoint of the code‑projects Online Application System for Admission allows an attacker to inject arbitrary SQL statements. The injection occurs because user-supplied data is incorporated into queries without proper sanitization or parameterization. An attacker can thus read, modify or delete database records, potentially exposing sensitive applicant information and compromising the integrity and confidentiality of the admissions database.

The vulnerability exists in code‑projects Online Application System for Admission version 1.0. No specific sub‑version details are provided, but the affected component is the "Enrollment" module accessed through /enrollment/admsnform.php. Users running this system should verify whether they are using the mentioned product and assess whether their deployment includes the vulnerable component.

The CVSS score of 5.3 indicates a medium severity impact. While the EPSS score is not available, the vulnerability is publicly disclosed and can be exploited remotely over the network without local access. It is not listed in CISA's KEV catalog, but its presence in the public domain means attackers could craft tailored payloads. The lack of a mitigation published by the vendor increases the likelihood of exploitation if the issue remains unpatched.