This vulnerability in ningzichun Student Management System up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf involves hard-coded credentials in the mysqli_connect function within config/database.php. This flaw allows remote attackers to exploit the hard-coded credentials to gain unauthorized access to the database. The product's rolling release model means no discrete version numbers are available to define affected releases. The issue was reported early to the project, but no vendor response or patch has been provided. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, with low to limited impact on confidentiality, integrity, and availability.

The vulnerability allows remote attackers to leverage hard-coded database credentials, potentially leading to unauthorized database access. This could compromise data confidentiality and integrity, though the impact is rated as medium severity. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor for vendor updates. As a temporary measure, consider restricting network access to the affected system and auditing database access logs for suspicious activity.