This vulnerability involves an SQL injection in the admin/admin_login.php file of the imvks786 student_management_system. By manipulating the a_usr or a_pwd arguments, an attacker can inject SQL commands remotely without authentication or user interaction. The product's rolling release model complicates version tracking for affected or fixed releases. No official patch or mitigation guidance is currently available from the vendor, and the issue remains unaddressed despite early reporting.

Successful exploitation could allow remote attackers to execute arbitrary SQL commands on the backend database via the Administrator Login Endpoint. This may lead to unauthorized data access, modification, or other database impacts. The CVSS score of 6.9 indicates a medium severity with network attack vector and no required privileges or user interaction. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing application-level protections such as input validation or web application firewalls to mitigate SQL injection risks until an official patch is available.