The itsourcecode Fees Management System 1.0 contains a SQL injection vulnerability in the /ajax.php file. An attacker can manipulate the Username parameter to inject SQL commands, potentially compromising the backend database. The vulnerability is remotely exploitable, requires low privileges, and does not require user interaction. The CVSS 4.0 base score is 5.3, indicating medium severity. No vendor advisory or patch information is provided, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the database used by the Fees Management System, potentially leading to unauthorized data access or modification. The impact is limited by the low privileges required and the low complexity of the attack, but the vulnerability still poses a risk to data confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint and monitor for suspicious activity related to the Username parameter. Avoid exposing the /ajax.php interface to untrusted networks if possible.