The flaw lies in the /index.php SQL handler of SourceCodester CET Automated Grading System with AI Predictive Analytics, where crafted input can trigger error messages that expose internal details. The vulnerability is a classic instance of CWE‑200 (Information Exposure) combined with CWE‑209 (Improper Exposure of Personal Information). It can be inferred that the information exposed is system or database information, so the impact is exposure of potentially sensitive data rather than direct code execution or disruption.

The flaw affects SourceCodester CET Automated Grading System with AI Predictive Analytics version 1.0. The vulnerability is located in the /index.php file, which serves as the SQL handler for the application. Any instance of this product running that code path is potentially vulnerable if detailed error output is enabled; detailed error output being enabled is not stated, but it can be inferred that enabled error output would expose more information. The application is publicly available through SourceCodester’s website.

The CVSS score of 5.3 denotes a moderate severity vulnerability. The EPSS score is currently not available, and the flaw is not listed in CISA’s KEV catalog, implying no confirmed large‑scale exploitation yet. However, a proof‑of‑concept exploit has been published publicly, enabling remote attackers to trigger the vulnerable code path and retrieve the detailed error information. Given the nature of the attack vector—remote web request—the risk remains significant for unprotected instances, especially if detailed error output is enabled. It can be inferred that enabling detailed error output would exacerbate the exposure. The absence of a known patch at this time shifts the focus to configuring the application to limit error exposure and monitoring the vendor for any remediation updates.