This vulnerability (CVE-2025-47573) in mojoomla School Management is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. It enables Blind SQL Injection attacks, which can allow an attacker to extract sensitive information from the database without direct feedback. The CVSS 3.1 base score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and a high confidentiality impact but no integrity impact and low availability impact. The affected versions include all versions up to 92.0.0. No patch or mitigation details are currently available.

Successful exploitation can lead to unauthorized disclosure of sensitive data due to Blind SQL Injection. The confidentiality impact is high, while integrity is not affected and availability impact is low. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider applying any available workarounds from the vendor or restrict access to the affected application to trusted networks. Monitor official mojoomla channels for updates.