This critical SQL injection vulnerability in the School-management-system 1.0 allows unauthenticated remote attackers to compromise the underlying database.

This is a time-based blind SQL injection flaw located in the between-date-reprtsdetails.php file, which fails to properly sanitize the fromdate POST parameter, allowing unauthenticated remote execution.

The vulnerability carries a CVSS score of 9.8, reflecting its potential for full database compromise. Successful exploitation could lead to unauthorized access to sensitive student and administrative records, data exfiltration, or complete system takeover, resulting in significant regulatory and reputational damage.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected script via firewall rules or by disabling the module if not required.

Proactive Monitoring: Monitor database query logs for unusual time-based delays or patterns indicative of blind SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rulesets designed to detect and block SQL injection payloads targeting POST parameters.

Public Exploit Available: Unknown.

Due to the critical nature of this vulnerability and the lack of a vendor-provided patch, immediate mitigation is required. Organizations using this software should prioritize network-level segmentation or WAF protections to prevent exploitation until the vendor releases a secure update.