This vulnerability involves an SQL injection in QueryMine sms up to commit 7ab5a9ea196209611134525ffc18de25c57d9593. The injection occurs through the GET parameter 'ID' in the admin/deletecourse.php component. An attacker can remotely exploit this flaw to manipulate backend SQL queries. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. The vendor has not provided any patch or official remediation, and the exploit is publicly available.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium based on CVSS 4.0 scoring. There is no indication of privilege or user interaction requirements, increasing the risk of remote exploitation. However, the exact extent of impact depends on the database and application context, which is not detailed in the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary mitigations such as input validation and parameterized queries if possible. Monitoring for unusual database activity may help detect exploitation attempts. Stay alert for vendor updates or community patches due to the public availability of exploit code.