प्लेटफ़ॉर्म
wordpress
घटक
school-management
में ठीक किया गया
92.0.1
CVE-2025-47573 describes a critical SQL Injection vulnerability discovered in mojoomla School Management. This flaw allows attackers to perform blind SQL injection, potentially leading to unauthorized data access and system compromise. The vulnerability impacts versions prior to 92.0.1, and a patch is available in version 92.0.1.
The SQL Injection vulnerability in mojoomla School Management poses a significant risk to data confidentiality and integrity. An attacker could leverage this flaw to bypass authentication mechanisms and directly query the database, extracting sensitive information such as student records, teacher details, financial data, and administrative credentials. Successful exploitation could lead to data breaches, identity theft, and disruption of school operations. The 'blind' nature of the injection means the attacker doesn't receive direct feedback from the database, requiring more sophisticated techniques to extract data, but doesn't inherently limit the potential impact. This type of vulnerability, if left unaddressed, can be exploited repeatedly.
CVE-2025-47573 was publicly disclosed on 2025-06-17. The vulnerability's severity is classified as CRITICAL (CVSS 9.3). No public proof-of-concept (PoC) code has been observed at the time of writing, but the nature of blind SQL injection makes it likely that such exploits will emerge. It is not currently listed on the CISA KEV catalog, but its critical severity warrants close monitoring.
Schools and educational institutions utilizing mojoomla School Management are at significant risk. Specifically, those running older, unpatched versions (prior to 92.0.1) are particularly vulnerable. Organizations relying on mojoomla for sensitive student data or administrative functions should prioritize patching.
• wordpress / composer / npm:
grep -r "SELECT .* FROM" /var/www/html/mojoomla/includes/• generic web:
curl -I https://your-mojoomla-site.com/ | grep SQL• wordpress / composer / npm:
wp plugin list | grep mojoomla• wordpress / composer / npm:
wp plugin update mojoomladisclosure
एक्सप्लॉइट स्थिति
EPSS
0.06% (18% शतमक)
CISA SSVC
CVSS वेक्टर
The primary mitigation for CVE-2025-47573 is to immediately upgrade mojoomla School Management to version 92.0.1 or later. If upgrading is not immediately feasible due to compatibility issues or downtime concerns, consider implementing temporary workarounds. While a direct WAF rule is difficult to craft for blind SQL injection, implementing strict input validation and parameterized queries at the application level can reduce the attack surface. Regularly review database access logs for suspicious activity, particularly queries containing unusual characters or patterns. Consider implementing a web application firewall (WAF) with SQL injection protection rules, although their effectiveness against blind injection can be limited.
Actualice el plugin School Management a una versión corregida. Consulte las notas de la versión del plugin o el sitio web del desarrollador para obtener instrucciones específicas sobre cómo actualizar y mitigar la vulnerabilidad de inyección SQL.
भेद्यता विश्लेषण और गंभीर अलर्ट सीधे आपके ईमेल में।
CVE-2025-47573 is a critical SQL Injection vulnerability affecting mojoomla School Management versions before 92.0.1, allowing attackers to extract data through blind SQL injection.
If you are using mojoomla School Management versions prior to 92.0.1, you are vulnerable to this SQL Injection flaw. Immediately check your version and upgrade.
Upgrade mojoomla School Management to version 92.0.1 or later to patch this vulnerability. If immediate upgrade is not possible, implement temporary workarounds like input validation and WAF rules.
While no active exploitation has been confirmed, the vulnerability's severity and the nature of blind SQL injection suggest it's likely to be targeted. Continuous monitoring is crucial.
Refer to the official mojoomla security advisory page for the most up-to-date information and guidance regarding CVE-2025-47573.
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।