This vulnerability involves SQL injection in the Login component of the imvks786 student_management_system, specifically through manipulation of the usr/pwd arguments in the /index.ph file. The flaw allows remote attackers to inject SQL commands, potentially compromising the database. The product's rolling release model obscures version details, and the vendor has not issued a fix or advisory. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, but with low confidentiality, integrity, and availability impacts. Exploit code is publicly available, increasing the risk of exploitation despite no current reports of active attacks.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database via the login interface, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. No known active exploitation has been reported.

No official patch or remediation guidance is currently available from the vendor, who has not responded to the issue report. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until a fix is released, users should consider applying application-level mitigations such as input validation or web application firewalls to detect and block SQL injection attempts.