This vulnerability affects itsourcecode Fees Management System 1.0 and involves SQL injection via the ID argument in the /manage_user.php file. An attacker can remotely manipulate this parameter to inject SQL commands, potentially compromising the database. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. No vendor-provided patch or fix has been documented, and the product is not a cloud service.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated as medium severity with limited confidentiality, integrity, and availability impact as per the CVSS vector. No active exploitation in the wild has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint, implement input validation or parameterized queries if possible, and monitor for suspicious activity related to the /manage_user.php ID parameter. No vendor advisory or official patch has been published at this time.