Platform
wordpress
Component
school-management
Fixed in
92.0.1
CVE-2025-47573 describes a critical SQL Injection vulnerability discovered in mojoomla School Management. This flaw allows attackers to perform blind SQL injection, potentially leading to unauthorized data access and system compromise. The vulnerability impacts versions prior to 92.0.1, and a patch is available in version 92.0.1.
The SQL Injection vulnerability in mojoomla School Management poses a significant risk to data confidentiality and integrity. An attacker could leverage this flaw to bypass authentication mechanisms and directly query the database, extracting sensitive information such as student records, teacher details, financial data, and administrative credentials. Successful exploitation could lead to data breaches, identity theft, and disruption of school operations. The 'blind' nature of the injection means the attacker doesn't receive direct feedback from the database, requiring more sophisticated techniques to extract data, but doesn't inherently limit the potential impact. This type of vulnerability, if left unaddressed, can be exploited repeatedly.
CVE-2025-47573 was publicly disclosed on 2025-06-17. The vulnerability's severity is classified as CRITICAL (CVSS 9.3). No public proof-of-concept (PoC) code has been observed at the time of writing, but the nature of blind SQL injection makes it likely that such exploits will emerge. It is not currently listed on the CISA KEV catalog, but its critical severity warrants close monitoring.
Exploit Status
EPSS
0.06% (18% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-47573 is to immediately upgrade mojoomla School Management to version 92.0.1 or later. If upgrading is not immediately feasible due to compatibility issues or downtime concerns, consider implementing temporary workarounds. While a direct WAF rule is difficult to craft for blind SQL injection, implementing strict input validation and parameterized queries at the application level can reduce the attack surface. Regularly review database access logs for suspicious activity, particularly queries containing unusual characters or patterns. Consider implementing a web application firewall (WAF) with SQL injection protection rules, although their effectiveness against blind injection can be limited.
Update the School Management plugin to a patched version. Refer to the plugin's release notes or the developer's website for specific instructions on how to update and mitigate the SQL Injection vulnerability.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-47573 is a critical SQL Injection vulnerability affecting mojoomla School Management versions before 92.0.1, allowing attackers to extract data through blind SQL injection.
If you are using mojoomla School Management versions prior to 92.0.1, you are vulnerable to this SQL Injection flaw. Immediately check your version and upgrade.
Upgrade mojoomla School Management to version 92.0.1 or later to patch this vulnerability. If immediate upgrade is not possible, implement temporary workarounds like input validation and WAF rules.
While no active exploitation has been confirmed, the vulnerability's severity and the nature of blind SQL injection suggest it's likely to be targeted. Continuous monitoring is crucial.
Refer to the official mojoomla security advisory page for the most up-to-date information and guidance regarding CVE-2025-47573.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.