This vulnerability (CVE-2025-47572) in mojoomla School Management arises from improper control of filenames used in PHP include or require statements, classified under CWE-98. It enables PHP Local File Inclusion, which can be leveraged by an attacker with low privileges to read or execute files on the server. The vulnerability affects all versions up to 93.0.0. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability. No patch or official fix has been published, and no known exploits are reported in the wild.

Successful exploitation can lead to high impact on confidentiality, integrity, and availability of the affected system. An attacker could include local files, potentially leading to arbitrary code execution or disclosure of sensitive data. The vulnerability requires network access and low privileges but no user interaction. The high CVSS score reflects the severity of these impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application, applying web application firewall rules to block malicious input targeting file inclusion, and reviewing server configurations to limit file inclusion risks. Monitor vendor channels for updates and official patches.