A vulnerability was discovered in the StudentManagementSystem's success.php file that permits attackers to inject arbitrary SQL statements via the User argument. The flaw arises from unsanitized input acceptance, allowing full control over the SQL query. This leads to a SQL injection that can compromise database confidentiality and integrity, potentially exposing sensitive student records or allowing unauthorized account creation. The weakness is related to CWE-74 and CWE-89.

The affected product is yashpokharna2555 StudentManagementSystem. No specific version numbers exist because the project deploys a rolling release model, so any current build may contain the vulnerability. The flaw resides in an unknown function within success.php and can be triggered remotely in any publicly accessible deployment.

The CVSS score of 6.9 indicates medium severity, while EPSS data is not available, making precise exploitation probability unclear. However, because the vulnerability has been publicly demonstrated and can be initiated remotely, the risk is significant. The lack of an official patch or workaround means attackers could exploit this flaw at any time. The vulnerability is not listed in the CISA KEV catalog, but the availability of a public exploit warrants immediate mitigation measures.