This vulnerability exists in code-projects Coaching Management System 1.0 within the POST handler of /cims/modules/admin/reply.php. By manipulating the complaintreply parameter, an attacker can inject SQL commands remotely, potentially compromising the backend database. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No vendor patch or official remediation has been published as of the data provided.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated as medium severity, with low confidentiality, integrity, and availability impacts according to the CVSS vector. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and sanitization on the complaintreply parameter to mitigate SQL injection risks. Monitoring for unusual database queries and restricting database permissions may also reduce potential impact.