The reported flaw resides in the Management Mutation Handler of sambitraj Student-Management-System. The handler accepts mutation arguments such as roll_no, name, father_name, class, mobile, email, password, and remark without adequate sanitization, enabling an attacker to inject arbitrary SQL statements that are executed against the underlying database. Successful injection can allow the attacker to read, modify, or delete student records, thereby compromising database confidentiality and integrity.

All releases of sambitraj Student-Management-System up to the commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 are affected. The project follows a rolling release strategy, so specific version numbers are not published. The vulnerable component is the Management Mutation Handler within the server-side logic that processes mutation queries.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is publicly available, and the vulnerability is not recorded in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. However, a published exploit demonstrates that an attacker can trigger the vulnerability remotely via HTTP requests carrying specially crafted parameters, with no requirement for local code execution or privileged access.