SourceCodester School Registration and Fee System 1.0 contains a SQL injection vulnerability in an unknown function of the /bilal/normal/delete_stud.php file. An attacker can manipulate the selector[] parameter to perform SQL injection attacks remotely without any privileges or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) and was publicly disclosed on 2026-09-13. No vendor advisory or patch information is provided, and no known exploits are reported in the wild beyond the public disclosure.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This can lead to unauthorized data access, modification, or deletion within the affected system. The vulnerability's medium severity reflects the potential for data compromise but does not indicate immediate critical system takeover or widespread exploitation.

No official patch or remediation guidance is currently available from the vendor. Users of SourceCodester School Registration and Fee System 1.0 should monitor vendor channels for updates. In the meantime, restricting access to the vulnerable endpoint and applying web application firewall rules to detect and block SQL injection attempts may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.