This vulnerability (CVE-2025-47575) in mojoomla School Management is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). It allows an attacker with low privileges and no user interaction to execute crafted SQL commands remotely, potentially compromising confidentiality and causing limited availability issues. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, and partial confidentiality impact without integrity impact. Affected versions include all up to 92.0.0. No patch or vendor advisory is currently provided.

Successful exploitation could allow an attacker to execute unauthorized SQL commands, potentially exposing sensitive data (confidentiality impact) and causing limited disruption to service availability. Integrity impact is not indicated. The attack requires low privileges but no user interaction, increasing risk. No known exploits have been reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected application to trusted users only and monitor for unusual database activity. Avoid exposing the application to untrusted networks. Apply any official fixes promptly once released by mojoomla.