School Management System CVE-2026-6595

No special conditions - remote unauthenticated exploitation against default configurations of ProjectsAndPrograms School Management System. The buslocation.php endpoint with bus_id parameter must be accessible (standard deployment for schools offering bus tracking to parents). Exploitation limited only by network reachability to the web application. No required user interaction (UI:N), no privilege escalation needed (PR:N), and low attack complexity (AC:L) per CVSS vector. Successful exploitation does require attacker knowledge of database schema for targeted data extraction, though blind SQLi techniques work without schema knowledge.

Real-world risk is HIGH despite moderate CVSS 7.3 due to convergence of multiple high-risk factors. CVSS vector AV:N/AC:L/PR:N/UI:N indicates trivial exploitation: network-accessible, low complexity, no authentication required, no user interaction. Public exploit code exists (E:P in temporal score, confirmed by Feishu wiki reference), dramatically lowering attacker skill barrier. Vendor non-responsiveness (RL:X - no official fix) means vulnerability persists indefinitely. Impact spans all CIA triad elements (C:L/I:L/A:L) allowing data theft, modification, and service disruption. SSVC assessment: exploitation=POC, automatable=yes, technical impact=partial. Critical gap: no EPSS score provided, preventing statistical exploitation probability assessment. KEV status not applicable (small vendor, limited deployment). Primary concern is automated scanning and credential harvesting by opportunistic attackers targeting education sector installations.

Attacker discovers school using ProjectsAndPrograms School Management System through Shodan/Google dorking. Crafts malicious URL: http://target-school.edu/buslocation.php?bus_id=1' UNION SELECT username,password,email FROM users-- to extract administrator credentials from database. No authentication required (PR:N), attack executable from internet (AV:N) using publicly available exploit code from Feishu wiki. Stolen credentials enable full system compromise including student records access.