EUVD-2025-18538CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
3Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla School Management allows Blind SQL Injection. This issue affects School Management: from n/a through 92.0.0.
Analysis
Blind SQL injection vulnerability in mojoomla School Management that allows unauthenticated network attackers to extract sensitive data from the application's database without direct visibility of query results. The vulnerability affects School Management versions up to 92.0.0 and carries a CVSS score of 9.3, indicating critical severity. The attack requires no user interaction, no privileges, and low complexity, making it highly exploitable in real-world scenarios.
Technical Context
The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically manifesting as blind SQL injection. mojoomla School Management fails to properly sanitize or parameterize user-supplied input before incorporating it into SQL queries. Unlike classic SQL injection, blind SQL injection does not return database query results directly in the application response; instead, attackers infer data by observing conditional behavioral differences (response timing, boolean-based responses, or error-based discrepancies). The affected product is mojoomla School Management (CPE likely: cpe:2.3:a:mojoomla:school_management:*:*:*:*:*:*:*:*), versions from an unspecified baseline through 92.0.0. The vulnerability exists in input validation logic, typically in web request handlers processing student data, administrative parameters, or search/filter functions commonly found in school management portals.
Affected Products
School Management (0.0.0 through 92.0.0 (all versions up to and including 92.0.0))
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today