This vulnerability involves SQL injection in QueryMine sms up to commit 7ab5a9ea196209611134525ffc18de25c57d9593. The injection occurs through the GET parameter ID in the admin/deletecourse.php component, allowing remote attackers to manipulate database queries. The exploit is publicly available, increasing the risk of exploitation. Due to the rolling release model, precise affected or fixed versions are not specified. The vendor has not issued any advisory or patch, leaving remediation status unknown.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database via the vulnerable GET parameter. This may lead to unauthorized data access, modification, or deletion depending on the database privileges. The public availability of the exploit increases the likelihood of attacks. However, no known active exploitation in the wild has been reported. The medium CVSS score reflects the network attack vector and lack of required privileges but also the limited scope of impact as per available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor vendor channels for updates. As a temporary measure, restricting access to the vulnerable endpoint or implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter may reduce risk.