The vulnerability in itsourcecode Student Transcript Processing System 1.0 allows remote attackers to perform SQL injection via the studentId parameter in the /admin/modules/student/index.php?view=view endpoint. This improper input validation or sanitization leads to injection of malicious SQL commands. The vulnerability is unauthenticated and exploitable remotely. No official patch or remediation guidance is currently available from the vendor or authoritative sources. The CVSS 4.0 vector indicates low complexity, no privileges or user interaction required, and partial impacts on confidentiality, integrity, and availability.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion within the Student Transcript Processing System. Given the nature of the system, sensitive student data could be exposed or altered. The vulnerability does not require authentication and can be triggered remotely, increasing the risk of exploitation. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and sanitization on the studentId parameter to prevent SQL injection. Restrict access to the vulnerable endpoint to trusted users or networks where possible. Monitor for any updates from the vendor regarding patches or official mitigations.