This vulnerability exists in an unknown functionality of the loginCheckTest.php file within the Login component of the imranrisal-dev Student-Management-System. It allows remote attackers to perform SQL injection by manipulating the username or password arguments. The product lacks versioning, so specific affected versions cannot be determined. The vendor did not provide any response or patch information. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low to limited confidentiality, integrity, and availability impacts. Public exploit code is available, but no active exploitation has been confirmed.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The impact is rated medium severity based on the CVSS score of 6.9. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing application-level mitigations such as input validation, parameterized queries, or web application firewalls to reduce risk until a patch is released.