This vulnerability involves a SQL injection in the admin/admin_login.php file of the imvks786 student_management_system. By manipulating the a_usr or a_pwd parameters, an attacker can inject SQL commands remotely. The exact affected versions cannot be specified due to the product's rolling release model. No official remediation or patch has been provided by the vendor as of the publication date. The vulnerability is publicly known and exploitable but no confirmed exploits in the wild have been reported.

Successful exploitation can allow an unauthenticated remote attacker to execute arbitrary SQL commands via the Administrator Login Endpoint, potentially leading to unauthorized access or data compromise. The CVSS score of 6.9 indicates a medium severity impact with low complexity and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the admin login parameters.