The vulnerability is an SQL injection flaw where the book_name and book_author parameters are directly concatenated into a mysqli_query call in university.php, exposing the system to CWE-74 and CWE-89 weaknesses. An attacker can craft malicious input to execute arbitrary SQL statements, which can read, modify, or delete data in the underlying database, thereby compromising confidentiality, integrity, and availability.

The flaw resides in the Mstfakts College‑Management‑System, specifically within the Search Handler component (university.php). The project follows a rolling release model and does not publish fixed version ranges, so the exact affected releases cannot be determined.

The CVSS score of 6.9 indicates moderate-to-high severity. EPSS is not available and the vulnerability is not listed in CISA KEV, although a public exploit has been disclosed. The attack can be performed remotely via the web interface without prior authentication, making the likelihood of exploitation in reachable environments significant.