This vulnerability affects itsourcecode Student Transcript Processing System 1.0 and involves improper sanitization of input parameters studentId and cid in the /admin/modules/student/trans.php file. An attacker can remotely exploit this flaw to perform SQL injection, potentially allowing unauthorized database queries. The CVSS 4.0 base score is 6.9, indicating medium severity, with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability can allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited to the confidentiality, integrity, and availability of the affected system's data but does not extend to system-level compromise based on the CVSS vector. No known exploits in the wild have been confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or web application firewall rules to block malicious input targeting the studentId and cid parameters. Monitoring for unusual database queries related to these parameters may also help detect exploitation attempts.