CVE-2025-10112
📋 TL;DR
CVE-2025-10112 is a SQL injection vulnerability in itsourcecode Student Information Management System 1.0 that allows remote attackers to execute arbitrary SQL commands via the ID parameter in /admin/modules/department/index.php. This affects all organizations using this specific software version, potentially exposing sensitive student data and system control.
💻 Affected Systems
- itsourcecode Student Information Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, privilege escalation to admin, and potential remote code execution via database functions.
Likely Case
Unauthorized access to sensitive student records (grades, personal information), database content exfiltration, and potential system disruption.
If Mitigated
Limited impact with proper input validation, database permissions, and network segmentation preventing full system compromise.
🎯 Exploit Status
SQL injection via ID parameter is straightforward to exploit with common tools like sqlmap.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://itsourcecode.com/
Restart Required: No
Instructions:
No official patch available. Consider replacing with alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd parameter validation to only accept numeric values for ID parameter
Modify /admin/modules/department/index.php to add: if(!is_numeric($_GET['ID'])) { die('Invalid input'); }
Web Application Firewall Rule
allBlock SQL injection patterns targeting the vulnerable endpoint
WAF rule to block requests containing SQL keywords to /admin/modules/department/index.php
🧯 If You Can't Patch
- Network segmentation: Isolate the system from internet access and restrict to necessary internal networks only
- Database hardening: Implement least privilege database accounts, disable unnecessary database functions, and enable logging
🔍 How to Verify
Check if Vulnerable:
Test the endpoint with SQL injection payloads: /admin/modules/department/index.php?ID=1' OR '1'='1Check Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Test with same payloads and verify they are rejected or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from web server
- Multiple failed login attempts following SQL errors
- Requests to /admin/modules/department/index.php with SQL keywords
Network Indicators:
- HTTP requests containing SQL injection patterns to vulnerable endpoint
- Unusual outbound database connections from web server
SIEM Query:
source="web_logs" AND uri="/admin/modules/department/index.php" AND (query CONTAINS "UNION" OR query CONTAINS "SELECT" OR query CONTAINS "OR '1'='1'")