The vulnerability is a classic SQL injection that occurs when the query parameter "ay" is passed to an unvalidated function in /ramonsys/report/index.php. An attacker can manipulate this argument to inject arbitrary SQL code, potentially allowing data extraction, modification, or denial of service. The weakness aligns with CWE-74 and CWE-89, indicating improper handling of external input and standard SQL injection. The impact is limited to the database accessed by the vulnerable application, but the lack of authentication requirements means any remote user can exploit it.

itsourcecode School Management System 1.0, the only version referenced in the CVE data. No other versions or products are listed as affected.

The CVSS score of 6.9 classifies the vulnerability as moderate severity, and the EPSS score of less than 1% indicates a very low probability of exploitation at present, though the vulnerability is publicly available and can be triggered remotely. Because the attack requires only a remote HTTP request with a crafted "ay" parameter, the threat window is open for anyone who can reach the application externally. The vulnerability is not currently listed in CISA’s KEV catalog, which suggests no confirmed large‑scale exploitation so far. Nonetheless, the possibility of credential compromise or data tampering remains significant if an attacker gains access via this vector.