PHPGurukul Student Record System version 3.20 contains an SQL Injection vulnerability in the add-subject.php script via the sub1, sub2, sub3, sub4, and course-short parameters. This flaw allows an unauthenticated attacker to inject malicious SQL commands, potentially leading to unauthorized access or data manipulation. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.