A vulnerability in itsourcecode School Management System allows an attacker to inject arbitrary SQL statements by tampering with the ID parameter in the /subject/index.php file. This flaw qualifies as a classic SQL injection (CWE‑74 and CWE‑89). If exploited, an attacker could read, modify, or delete sensitive database contents, potentially compromising the confidentiality and integrity of student records and other proprietary data. The CVE description states that the attack can be carried out remotely, and a public exploit has already been released.

The affected software is itsourcecode School Management System version 1.0. No other product or version information is listed, so mitigation should focus specifically on this release.

The vulnerability carries a CVSS score of 6.9, indicating moderate severity, and an EPSS score of less than 1 %. Although it is not yet listed in the CISA KEV catalog, the publicly available exploit and the ability to launch the attack remotely make it prudent to treat it as a significant risk. An attacker would typically send a crafted HTTP request containing a malicious payload in the ID field to /subject/index.php, which the server processes without proper sanitization, leading to execution of unintended SQL statements.