This vulnerability in Kushan2k student-management-system up to commit f16a4ceaddd6729c4b306ed4641cda3176c1ef2a allows remote attackers to exploit SQL injection via the 'nic' parameter in the getStatus function of controllers/GradeController.php. The product's rolling release nature means no fixed or affected version numbers are provided. The vulnerability is publicly known, but no official remediation or patch has been released as of the publication date.

Successful exploitation can lead to SQL injection attacks, potentially allowing unauthorized access or manipulation of the database. The CVSS 4.0 score of 5.3 indicates a medium severity with network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is available, users should monitor official channels for updates. Until a fix is released, avoid exposing the vulnerable endpoint to untrusted networks or implement application-layer protections such as input validation or web application firewalls to mitigate exploitation risk.