A SQL injection vulnerability exists in the ProjectsAndPrograms School Management System within the file buslocation.php, where the HTTP GET parameter bus_id is unconstrained and directly incorporated into database queries. Attacking this endpoint allows remote exploitation; the attacker can inject arbitrary SQL statements, potentially reading, modifying, or deleting database records. The flaw is publicly documented and exploitable without special credentials, presenting a threat to the confidentiality, integrity, and availability of the system’s data.

The affected product is ProjectsAndPrograms School Management System. The vulnerability applies to releases up to commit 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Because the product follows a rolling release model, no specific version numbers are listed, and updated releases are not available at the time of disclosure.

The CVSS score of 6.9 classifies the flaw as moderate severity, and the lack of an EPSS score indicates no publicly available exploitation frequency data, though the exploit is documented as publicly available. The vulnerability is not listed in KEV, and the roll‑through nature of the product makes patching uncertain. The likely attack vector is a remote HTTP GET request to buslocation.php with a crafted bus_id value; an attacker with network access to the web application could exploit the flaw without authentication. Given these factors, the risk is moderate to high, particularly if sensitive data is stored in the database.