This vulnerability in QueryMine sms up to commit 7ab5a9ea196209611134525ffc18de25c57d9593 involves SQL injection through the ID parameter in the admin/editcourse.php component's GET request handler. An attacker can remotely exploit this flaw to inject SQL commands, potentially impacting data integrity or confidentiality. The vendor has not provided any advisory or patch, and the continuous rolling release model complicates version tracking. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated low for confidentiality, integrity, and availability, suggesting limited or partial impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing input validation or parameterized queries as a temporary mitigation if possible. Monitor for vendor updates or community patches due to the continuous delivery model.