This vulnerability involves SQL injection in the yashpokharna2555 StudentManagementSystem at the /success.php endpoint via the User parameter. The weakness allows remote attackers to inject SQL commands due to insufficient input validation or sanitization. The vulnerability is confirmed with a CVSS 4.0 score of 6.9 (medium severity). The vendor has not yet responded or provided a fix, and no patch or updated release information is available due to the rolling release nature of the product. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This could lead to unauthorized data access, data modification, or other database impacts depending on the database privileges. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, consistent with the medium severity rating. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. In the meantime, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the /success.php endpoint and the User parameter. Avoid exposing this endpoint unnecessarily and review application code for input validation improvements.