SQL Injection vulnerability in Eskooly Web Product v.3.0 allows a remote attacker to execute arbitrary code via the searchby parameter of the allstudents.php component and the id parameter of the requestmanager.php component.
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')