I spotted this post because it has the word Frog in it, but it's a question we're often asked, so I thought I'd send a reply.
As a rule you should never update a third party database directly. The risk of breaking "referential integrity" is too great. You might notice that you've broken it straight away, you might notice 6 months later. Either way, you would have to be very "lucky" rather than very "skilled" not to break it. While I've never personally seen the CMIS schema, it's worth mentioning that there are all sorts of reasons why databases are not 100% normalised, typically related to performance. If you are not aware of the exact details of any system's intentionally denormalised data, caching tables, (design flaws) and so on then the data will inevitably become inconsistent.
It's for this reason that commercial database suppliers typically provide an API - a set of business objects, or web services that handle read and write to the database while ensuring that the referential integrity is maintained. This approach also ensures that as the database is changed by the supplier in subsequent releases that your code doesn't break further down the line.
We have been working with CMIS for a few years now. Initially we accessed their database directly through ODBC drivers. Serco have recently started a partner programme and are building a library of web services. I believe that they have only got as far as reading data out, but I'm sure it's only a matter of time before they provide web services to write data back as well.
As tempting as it may be to just "get stuck in there", I would recommend patience. I would be extremely surprised if Serco were happy to provide support to your school if they felt that the school had been responsible for "breaking the data."
There may well be other ways of skinning the cat though, it depends on exactly what you're trying to achieve.
Hope this has been helpful.
Gareth