This vulnerability affects lavkush-maurya Student-Registration-System version 1.0. It arises from improper sanitization of the 'oldpass' parameter in a function located in /student/changepass.php, allowing an attacker to perform SQL injection remotely. The vulnerability has been publicly disclosed, and exploit code is available. The vendor has not issued any response or patch. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to execute arbitrary SQL commands on the backend database remotely by manipulating the 'oldpass' parameter. This can lead to unauthorized data access or modification. However, the impact is rated as low for confidentiality, integrity, and availability, indicating limited damage potential. No active exploitation in the wild has been reported.

No official fix or patch is currently available, and the vendor has not responded to disclosure. Users should monitor the vendor advisory for updates. Until a patch is released, consider implementing application-level input validation or web application firewall rules to detect and block SQL injection attempts targeting the 'oldpass' parameter in /student/changepass.php.