A flaw was discovered in PHPGurukul Online Course Registration version 3.1 that allows an attacker to inject arbitrary SQL through the regno parameter in the check_availability.php endpoint. The injection can be executed remotely without authentication and can be used to read, modify, or delete protected data in the database. This violation of confidentiality and integrity is derived from the identified CWE‑89 and results in potential data exposure or unauthorized data manipulation.

The vulnerability affects installations of PHPGurukul’s Online Course Registration system, specifically version 3.1. No additional sub‑versions are disclosed; the impact covers all deployments that contain the mentioned check_availability.php file.

The CVSS score of 6.9 indicates moderate severity. Although EPSS data is missing and the issue is not listed in CISA’s KEV catalog, the public disclosure and remote nature of the attack raise concern. An attacker can exploit the flaw by submitting a crafted regno value from a web browser or automated script, triggering the SQL injection and potentially extracting or altering database contents. Because no mitigation is required beyond updating to a patch, the risk is primarily mitigated by applying a patch immediately.