An unauthenticated remote SQL injection vulnerability in the ProjectsAndPrograms School Management System allows attackers to manipulate database queries, posing a significant risk of data exposure.

This vulnerability is an SQL Injection (CWE-89) flaw located in the buslocation.php file. The application fails to properly sanitize the bus_id argument provided via an HTTP GET request, which allows an unauthenticated attacker to remotely inject malicious SQL commands.

Successful exploitation of this vulnerability allows unauthorized access to the underlying database, potentially leading to the theft, modification, or destruction of sensitive school management data. Given the CVSS score of 7.3, this flaw presents a high risk to data confidentiality and integrity, particularly in environments where student or administrative records are stored.

Immediate Action: Because the vendor has not provided an official patch and utilizes a rolling release model, administrators should restrict access to the buslocation.php endpoint or disable the affected module entirely until the vendor releases a secure update.

Proactive Monitoring: Security teams should audit web server access logs for anomalous GET requests containing SQL syntax or suspicious characters in the bus_id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection patterns specifically targeting the bus_id parameter in HTTP requests.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the technical write-up referenced at the Feishu wiki link provided in the vulnerability record.

The high severity of this SQL injection vulnerability necessitates immediate defensive action. Since an official fix is currently unavailable, organizations must prioritize implementing network-level filtering or WAF rules to intercept malicious traffic. Continued monitoring of system logs is essential to detect any attempts to leverage the publicly available proof-of-concept against your environment.