The vulnerability resides in the Student Transcript Processing System version 1.0, specifically within the admin module trans.php. By manipulating the studentId or cid arguments, an attacker can inject arbitrary SQL statements. This flaw allows unauthorized execution of database commands, potentially exposing confidential student information, altering records, or compromising the integrity of the transcript database. The injection point directly interacts with the backend database.

Itsourcecode Student Transcript Processing System 1.0 is affected. The flaw is located in the admin/modules/student/trans.php file, and any deployment of this version is susceptible. No other components or versions are explicitly listed as affected in the available data.

The CVSS score of 6.9 denotes medium severity. While no EPSS score is available, the public publication of an exploit script indicates that the vulnerability is actively used in the wild. Attackers can reach the vulnerable endpoint remotely via standard HTTP requests, manipulating parameters without needing prior authentication. Because the flaw is an injection point, the attack requires only the ability to pass crafted input to the vulnerable endpoint, making it highly accessible for adversaries. The vulnerability is not listed in the CISA KEV catalog, yet its exploitability remains significant due to public availability of exploit code.