A flaw in the email argument of user/check_availability.php allows an attacker to inject arbitrary SQL. This Injection flaw is a classic example of CWE-74 and CWE-89, where untrusted input is concatenated into a database query. If exploited, an attacker could read, modify, or delete complaint records and potentially retrieve sensitive user information, leading to confidentiality and integrity violations.

The vulnerability exists in PHPGurukul Complaint Management System version 1.0. The affected file is user/check_availability.php. No other product versions or sub‑products were identified in the CNA data.

The CVSS score of 6.9 indicates a medium severity issue. The EPSS score is not available, and the problem is not listed in KEV. Remote exploitation is possible because the vulnerable parameter is reachable over HTTP. Public exploitation code has been released, so an attacker can craft a request to the vulnerable script and perform SQL injection to compromise the underlying database.