Critical SQLi Hits School Management System

The National Vulnerability Database (NVD) has flagged CVE-2025-65135, a critical time-based blind SQL injection vulnerability in manikandan580’s School-management-system version 1.0. This flaw, rated with a CVSS score of 9.8, resides in the /studentms/admin/between-date-reprtsdetails.php component and is exploitable via the fromdate POST parameter.

SQL injection, especially a blind variant, is a nasty piece of work. Attackers can leverage this to extract sensitive data from the underlying database, potentially including student records, administrative credentials, and other confidential information, without directly seeing the database’s output. The ‘time-based’ aspect means they’d infer data by measuring response times, a slower but equally effective exfiltration method. Given the ‘Critical’ severity, this isn’t just a theoretical risk; it’s a gaping hole that demands immediate attention for anyone running this specific system.