This vulnerability in yashpokharna2555 StudentManagementSystem allows remote attackers to perform SQL injection via manipulation of the FIRST_NAME, Last_Name, or EMAIL arguments in the confirm_logged_in function within student_trans.php. The issue is due to insufficient input validation or sanitization, enabling crafted input to alter SQL queries. Although publicly disclosed, the vendor has not responded or provided a patch. The rolling release model complicates version tracking for affected or fixed releases. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low confidentiality, integrity, and availability impacts.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The impact is rated medium, reflecting limited but meaningful confidentiality, integrity, and availability impacts. There are no known exploits in the wild at this time.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no patch links exist, users should monitor the vendor's communications for updates. Until a fix is provided, consider implementing application-level input validation or web application firewall (WAF) rules to detect and block suspicious SQL injection attempts targeting the affected parameters.