This vulnerability affects lavkush-maurya Student-Registration-System version 1.0. An attacker can exploit a SQL injection flaw by manipulating the 'oldpass' parameter in the /student/changepass.php script. The vulnerability allows remote exploitation without user interaction or privileges beyond low-level access. The vendor was notified but has not responded, and no official fix or patch is currently available. The CVSS 4.0 base score is 5.3, indicating medium severity.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without user interaction, increasing risk. However, the impact is rated medium due to limited privileges required and low complexity of attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is available and the vendor has not responded, users should consider implementing application-level mitigations such as input validation and parameterized queries to reduce risk until an official patch is released.