The vulnerability in School Management System 1.0 allows an attacker to inject arbitrary SQL statements by manipulating an unvalidated ID parameter in an unknown function of /ramonsys/user/index.php. This is a classic SQL injection weakness (CWE‑74 and CWE‑89). The likely impact of a successful exploitation is that the attacker could read, modify or delete data in the application database, but the CVE does not state the exact range of compromise. The flaw can be triggered from a remote host without local privileges.

School Management System 1.0 from itsourcecode is the only version specifically identified as affected. The vulnerability resides in file /ramonsys/user/index.php and applies to the CPE entries described for this product.

The CVSS v3 base score is 6.9, indicating moderate severity. The EPSS score of less than 1% suggests that automated exploitation is unlikely, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending a crafted HTTP request containing a malicious ID value to the vulnerable endpoint from a remote location.