Institute-of-Current-Students version 1.0 has a time-based blind SQL injection vulnerability in the mydetailsstudent.php endpoint. The vulnerability arises because the 'myds' GET parameter is not properly sanitized before being used in SQL queries, allowing an attacker to perform time-based blind SQL injection attacks.