This vulnerability in the imranrisal-dev Student-Management-System involves SQL injection via the username or password parameters in the loginCheckTest.php file of the Login component. The flaw allows an unauthenticated remote attacker to inject SQL commands, potentially compromising the backend database. The product lacks versioning, preventing precise identification of affected versions. The vendor has not provided any response or patch. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely without authentication. This may lead to unauthorized data access or modification. However, the impact is rated medium due to low confidentiality, integrity, and availability impacts as per the CVSS vector. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing application-layer mitigations such as input validation, parameterized queries, or web application firewalls to reduce risk until an official patch is released.