This vulnerability in PHPGurukul Daily Expense Tracking System 1.1 allows remote attackers to perform SQL injection via the email parameter in the /register.php script. The injection flaw enables attackers to manipulate backend SQL queries, potentially compromising the database. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No vendor-provided patch or fix information is available at this time.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability affects confidentiality, integrity, and availability to a limited extent. Since the exploit is publicly available, the risk of exploitation is increased. However, no known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to apply input validation and parameterized queries on the email parameter in /register.php to prevent SQL injection. Monitor for updates from PHPGurukul regarding an official patch or mitigation.