This vulnerability affects the raisulislamg4 student_management_system_by_php, specifically in the delete.php file. An attacker can manipulate certain input parameters (user_id, course_id, teacher_id, student_id, application_id) to perform SQL injection attacks remotely. The product uses a rolling release model, so no fixed or affected version numbers are provided. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), indicating it is exploitable over the network without privileges or user interaction but with limited impact on confidentiality, integrity, and availability. The vendor has not yet responded or provided a patch or mitigation.

Successful exploitation allows remote attackers to execute arbitrary SQL commands via crafted input parameters, potentially leading to unauthorized data access or modification. The impact is rated medium, reflecting limited but meaningful compromise of the system's data integrity and confidentiality. There is no evidence of active exploitation in the wild at this time.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fixes have been published, users should consider implementing temporary mitigations such as input validation and parameterized queries if possible. Monitor vendor channels for updates and apply patches promptly once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.