This vulnerability involves improper handling of the 'subjcode' parameter in the scheduleSubList.php file of itsourcecode Online Student Enrollment System v1.0. The parameter is directly interpolated into an SQL query string without sanitization or validation, leading to a SQL injection flaw. This could allow an attacker to alter the intended SQL commands executed by the database. No CVSS score or detailed vendor advisory is available, and no patch or mitigation has been documented.

An attacker exploiting this vulnerability could manipulate SQL queries executed by the application, potentially leading to unauthorized data access or modification. However, no known exploits have been reported in the wild, and the exact impact depends on the database and application context. Without further details, the impact is limited to the risk of SQL injection in the affected component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the 'subjcode' parameter to prevent SQL injection. Employing parameterized queries or prepared statements is advised to mitigate this vulnerability.