A SQL injection vulnerability permits attackers to alter database queries through crafted HTTP requests. The flaw is exploitable by unauthenticated or authenticated users and can lead to extraction of sensitive database contents such as student records, login credentials, or administrative data. This represents a significant confidentiality breach and, if the attacker gains write privileges, could also modify or delete critical information. The weakness corresponds to the classic SQL injection flaw (CWE‑89).

The affected product is the School Management System version 1.0 developed by manikandan580. No other vendors or versions are listed.

Because the vulnerability is accessible via an HTTP endpoint without requiring authentication, the attack vector is likely straightforward for remote actors. The EPSS score is not available, and the issue is not currently catalogued by CISA, but the lack of authentication and the potential for data leakage suggest a high risk level. Until remediation is applied, any system hosting the unpatched application could be used to exfiltrate confidential data.