A SQL injection vulnerability exists in the GET request handler for the ID parameter within admin/deletecourse.php of QueryMine sms. By manipulating this argument, an attacker controlling the request can inject arbitrary SQL statements, potentially reading, modifying, or deleting database contents. The flaw can be triggered remotely, and public exploits have already been shared, indicating the threat is active.

Any instance of QueryMine sms that still includes the affected codebase up to commit 7ab5a9ea196209611134525ffc18de25c57d9593 remains vulnerable. The vendor employs a rolling release model, so specific patched versions are not listed, and the organization has not provided a fixed version. All customers running the product without an updated build must consider this weakness.

The CVSS score of 6.9 reflects a moderate to high impact, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, relying on unsanitized user input. An exploit can execute arbitrary SQL on the underlying database, allowing attackers to exfiltrate sensitive data, alter records, or potentially elevate privileges if the database user has broader rights.