A SQL injection vulnerability permits attackers to alter database queries through crafted HTTP requests. The flaw is exploitable by unauthenticated or authenticated users and can lead to extraction of sensitive database contents such as student records, login credentials, or administrative data. This represents a significant confidentiality breach and, if the attacker gains write privileges, could also modify or delete critical information. The weakness corresponds to the classic SQL injection flaw (CWE‑89).

The affected product is the School Management System version 1.0 developed by manikandan580. No other vendors or versions are listed.

Because the vulnerability is accessible via an HTTP endpoint without requiring authentication, the attack vector is likely straightforward for remote actors. The EPSS score of 0.0003% indicates a very low probability of exploitation by malicious actors, but the CVSS score of 9.8 signifies critical severity. The issue is not catalogued by CISA, yet the lack of authentication and potential for data leakage suggest a high risk level for any system hosting the unpatched application.