This vulnerability involves an SQL injection flaw in the Faculty Management System 1.0 by code-projects. Specifically, the ID argument in the /subject-print.php file is improperly sanitized, allowing attackers to inject malicious SQL queries remotely without authentication or user interaction. The CVSS 4.0 base score is 6.9, indicating a medium severity risk. The vulnerability is publicly known, but no vendor patch or official fix has been disclosed yet.

Successful exploitation could allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability does not require privileges or user interaction, increasing its risk. However, the impact is rated medium due to limited details on the extent of data exposure or system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to apply input validation or filtering on the ID parameter in /subject-print.php to mitigate SQL injection risks. Monitoring for unusual database queries and restricting database permissions may also help reduce impact.