This vulnerability exists in the raisulislamg4 student_management_system_by_php up to commit 310d950e09013d5133c6b9210aff9444382d16d1. The issue is an SQL injection caused by improper sanitization of the 'role' parameter in the add_user_check.php file's User Creation Handler. An attacker can remotely exploit this flaw without privileges or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. The vendor has not issued any patch or official remediation guidance as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impacts and no requirement for privileges or user interaction. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing manual input validation and sanitization for the 'role' parameter in add_user_check.php as a temporary mitigation. Monitor official channels for updates or patches from the vendor.