This vulnerability in sambitraj Student-Management-System up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 allows remote attackers to perform SQL injection via manipulation of input parameters related to student management (roll_no, name, father_name, class, mobile, email, password, remark) in the Management Mutation Handler component. The product's rolling release model prevents specifying exact affected versions. The vendor has not issued a fix or advisory. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and privileges. However, the overall impact is rated medium due to limited scope and lack of confirmed exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. In the meantime, consider applying input validation or web application firewall rules to detect and block SQL injection attempts targeting the specified parameters.