CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla School Management allows SQL Injection. This issue affects School Management: from n/a through 92.0.0.
Explanation of Vulnerability in Simple Terms
School Management for Joomla contains a SQL injection vulnerability in versions up to 92.0.0. An attacker with low-level user access can inject malicious SQL commands to read sensitive data from the database, including user credentials and site configuration. The vulnerability requires authentication but no user interaction. Scope is changed, meaning the impact extends beyond the vulnerable component.
What an attacker can do
Read sensitive data from the site database, including user credentials and configuration details.
Potential impact on your site
User passwords, email addresses, and other database records can be exposed to authenticated attackers.
Conditions required to exploit
Attacker must have a low-level user account on the Joomla site (e.g., registered user or contributor).
Key dates
External resources
