The StudentManagementSystem’s confirm_logged_in function in student_trans.php contains a SQL injection flaw because user input from the FIRST_NAME, Last_Name, and EMAIL parameters is inserted directly into SQL statements without proper sanitization. The vulnerability is confirmed to be exploitable by sending crafted input virtually from any location having network access to the web service. It is inferred from the nature of SQL injection that a successful exploit could allow an attacker to read, modify, or delete data stored in the database, leading to confidentiality, integrity, or availability problems.

This weakness affects the StudentManagementSystem project maintained by yashpokharna2555. The project follows a rolling‑release model and does not publish discrete version numbers, so the flaw may be present in all current releases until the developer releases a fix. No patch or updated version is currently available, and the maintainer has not responded to the reported issue.

The CVSS score of 6.9 indicates moderate to high severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting that known exploitation is not documented as of now. Attackers can trigger the flaw remotely through the normal web interface, exploiting the absence of input validation and the use of dynamic SQL in confirm_logged_in. This allows an attacker to manipulate database queries, potentially exposing or altering sensitive data.