The itsourcecode Fees Management System 1.0 contains a SQL injection vulnerability in the /ajax.php file. Specifically, the Username parameter is susceptible to injection attacks, allowing an attacker to manipulate SQL queries executed by the system. This vulnerability is remotely exploitable without user interaction and requires low privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. No official patch or remediation level has been disclosed by the vendor, and no known exploits are currently active in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion depending on the database permissions. The vulnerability affects the confidentiality, integrity, and availability of the system at a low to limited level as indicated by the CVSS vector components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint, implement input validation or filtering on the Username parameter if possible, and monitor for suspicious activity related to SQL injection attempts.