This vulnerability in SourceCodester Advanced School Management System 1.0 involves SQL injection via the checkEmail endpoint in commonController.php. An attacker can remotely exploit this flaw to inject malicious SQL commands due to insufficient input validation or sanitization. The CVSS 4.0 base score is 6.9, reflecting a medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official fix or patch has been disclosed, and the exploit code is publicly available.

Successful exploitation can allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion, potentially compromising the confidentiality and integrity of the system's data. Availability impact is limited. Since the exploit is public, the risk of attacks is increased.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to apply input validation and sanitization on the checkEmail endpoint, restrict database permissions to minimize impact, and monitor for suspicious activity. Avoid exposing the vulnerable endpoint publicly if possible.