The code-projects Student Admission System version 1.0 contains a SQL injection vulnerability in an unknown function of the /index.php file. The vulnerability arises from improper sanitization of the eid and did parameters, allowing an attacker to inject malicious SQL commands remotely without authentication or user interaction. This could potentially lead to unauthorized data access or modification. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the network attack vector, low complexity, and no privileges or user interaction required. No official fix or patch is currently documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database of the Student Admission System. This may result in unauthorized disclosure, modification, or deletion of sensitive student admission data. Since the attack can be performed remotely without authentication, the system is exposed to external threats. However, the impact is rated medium due to the lack of evidence of active exploitation and the limited scope described.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to implement input validation and sanitization on the eid and did parameters to mitigate SQL injection risks. Monitoring for unusual database queries and restricting database permissions may also help reduce potential impact. Avoid exposing the vulnerable application to untrusted networks if possible.