This vulnerability exists in the SourceCodester Simple Student Information System within the file app/admin/departments/view_department.php. By manipulating the ID parameter, an attacker can inject SQL commands remotely, potentially compromising the database. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available from the vendor. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, with low to limited impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to limited confidentiality, integrity, and availability impact as per the CVSS vector. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider implementing input validation or web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter in app/admin/departments/view_department.php.