This vulnerability affects halex CourseSEL versions 1.0 and 1.1.0 in the HTTP GET parameter handler of the check_sel function. Manipulating the 'seid' parameter leads to SQL injection, enabling remote attackers to potentially execute arbitrary SQL commands. The vulnerability is confirmed and publicly disclosed, with a CVSS 4.0 score of 5.3 (medium severity). The vendor has not issued any fix or advisory, and no patch links are available. The product is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation of this vulnerability could allow an attacker to execute unauthorized SQL commands on the backend database via the 'seid' parameter. This may lead to unauthorized data access or modification. However, the CVSS score and vector indicate limited impact due to low complexity and privileges required, and no user interaction needed. No known active exploitation has been reported.

No official patch or remediation is currently available from the vendor. Users should monitor vendor communications for updates. Until a fix is provided, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'seid' parameter. Review and harden input validation and parameter handling in the affected function if source code access is possible. Avoid exposing vulnerable endpoints publicly if feasible.