This vulnerability is a time-based blind SQL injection that can be triggered via the fromdate POST parameter in the between-date-reprtsdetails.php script of the school‑management‑system 1.0 application. By sending carefully crafted payloads that induce measurable delays on the server, an attacker can infer database contents, gain unauthorized access to sensitive data, and potentially modify or delete records, thereby compromising both the confidentiality and integrity of the system’s data. The nature of the weakness is a classic SQL injection.

The affected system is the open‑source School‑management‑system version 1.0. No vendor information beyond the application name is available; the issue appears to live in a community‑maintained codebase.

The CVSS score of 9.8 indicates a severe impact and easy exploitation. EPSS data is not available, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is a simple HTTP POST request to the vulnerable endpoint; authentication requirements are not stated, suggesting that the vulnerability may be exploitable by unauthenticated users or users with limited access. The combination of a high severity score, a direct attack path, and the absence of mitigation in the current version places this issue at high risk for exploitation.