This vulnerability in SourceCodester Advanced School Management System 1.0 involves SQL injection via an unknown function in the commonController.php file's checkEmail endpoint. An attacker can remotely exploit this flaw to inject malicious SQL commands, which may lead to unauthorized data access or manipulation. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. Public exploit code exists, but no official fix or patch has been published as of the data provided.

Successful exploitation can allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, modification, or deletion. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts. Since exploit code is publicly available, the risk of exploitation is elevated despite the absence of known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewalls (WAFs) or input validation controls to mitigate SQL injection risks. Monitoring for unusual database queries or access patterns may also help detect exploitation attempts. Avoid exposing the vulnerable endpoint publicly if possible.