A vulnerability was identified in itsourcecode School Management System version 1.0 affecting the /ramonsys/inquiry/index.php file. The flaw stems from the improper handling of the txtsearch parameter, which can lead to arbitrary SQL statements being executed against the underlying database. This flaw permits the execution of injected SQL and can be triggered remotely by supplying malicious input in the txtsearch field. The vulnerability corresponds to the web script injection (CWE‑74) and SQL injection (CWE‑89) weaknesses.

The School Management System from itsourcecode, version 1.0, is affected by the flaw in the inquiry module located under /ramonsys. No other versions or variants are listed in the available data.

The CVSS score of 6.9 indicates medium severity, while an EPSS score of less than 1% suggests a low probability of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack can be initiated remotely, and an attacker could gain unauthorized database access or manipulate data stored in the system. The flaw is publicly disclosed, increasing the likelihood that CUI or sensitive data may be compromised if exploited.