This vulnerability in QueryMine sms up to commit 7ab5a9ea196209611134525ffc18de25c57d9593 involves improper sanitization of the 'ID' parameter in the admin/editcourse.php component, leading to SQL injection. The attack vector is remote and requires no user interaction or privileges beyond low-level access. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. The vendor has not issued any advisory or patch, and due to the rolling release model, no fixed version details are available. Public exploit code exists, increasing the risk of exploitation despite no known active attacks.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database via the vulnerable 'ID' parameter, potentially leading to unauthorized data access or modification. The impact is rated low to medium on confidentiality, integrity, and availability, consistent with the CVSS vector. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary mitigations such as input validation and parameterized queries if possible. Monitor for updates from the vendor or community for patches or official mitigations.