A vulnerability exists in the Coaching Management System 1.0, specifically within the /cims/modules/admin/reply.php POST handler. By manipulating the complaintreply parameter, an attacker can inject arbitrary SQL statements. This is a classic example of CWE‑74 and CWE89 and can lead to unauthorized read or modification of the system database, potentially exposing sensitive information or corrupting data.

The affected system is the code‑projects Coaching Management System 1.0. The vulnerability resides in the admin reply.php module and is reachable via HTTP POST when the application is deployed. Any instance of version 1.0 that exposes the module over the network is susceptible.

With a CVSS score of 5.3 the risk is moderate, and the exploit is considered remote because the vulnerability can be triggered by an external HTTP request to the reply.php endpoint. The EPSS score is not available, and the flaw is not yet listed in the CISA KEV catalog. Because the exploit has been made public, an attacker could leverage existing exploit code to perform SQL injection against the database.