This vulnerability is an SQL injection flaw in the login.php page of itsourcecode's Electronic Judging System 1.0. By manipulating the Username parameter, an attacker can supply arbitrary SQL code that is executed by the backend database. The flaw can enable unauthorized disclosure, modification, or deletion of database content and may lead to privilege escalation, thereby compromising confidentiality, integrity, and availability of the system.

Affected constructs include the Electronic Judging System produced by itsourcecode, specifically version 1.0, where the vulnerable code resides in the /intrams/login.php module. The vulnerability may affect any deployment of this version accessed publicly over the network.

The CVSS score of 6.9 indicates a high severity risk, while the lack of an EPSS score means the probability of exploitation is unknown but the publicly available exploit and remote attack vector raise concerns. The vulnerability is not currently listed in the CISA KEV catalog. An attacker who controls a remote attack vector could inject SQL statements through the Username field, potentially gaining unauthorized data access or altering system state. System owners should evaluate whether this component is exposed to the Internet, assess the potential exposure of sensitive data, and treat the risk as moderate‑to‑high under the current context.