The Student Transcript Processing System version 1.0 contains a vulnerability where the ID argument of the URL /admin/modules/class/index.php?view=view is improperly validated. This flaw allows an attacker to inject arbitrary SQL statements; the vulnerability is a classic SQL injection (CWE-89). The flaw is exploitable remotely via HTTP GET parameters, and the attacker need only send crafted requests to the vulnerable endpoint.

Vendorship by ItsSourceCode, the affected product is the Student Transcript Processing System, specifically version 1.0. No additional affected versions are listed in the available data.

The CVSS score of 6.9 classifies this flaw as a medium severity issue. EPSS information is not provided, so the public exploitation probability is unknown, but the vulnerability is publicly disclosed and could be exploited by anyone with internet access. It is not listed in CISA’s KEV catalog, suggesting no confirmed exploit in the wild yet. The attack vector is remote, relying solely on manipulating HTTP GET parameters; an attacker need only send crafted requests to the vulnerable endpoint to execute malicious SQL.