This vulnerability affects itsourcecode Fees Management System 1.0. It involves an SQL injection flaw triggered by manipulating the ID parameter in the /manage_fee.php file. The vulnerability allows remote attackers to inject SQL commands due to insufficient input validation or sanitization. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. No official fix or patch has been disclosed as of the publication date.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited by the low privileges required and low scope impact, but the vulnerability still poses a risk to data integrity and confidentiality within the Fees Management System.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint, applying web application firewall rules to detect and block SQL injection attempts, and reviewing input validation controls on the ID parameter.