CVE-2025-10420
📋 TL;DR
This SQL injection vulnerability in SourceCodester Student Grading System 1.0 allows attackers to manipulate database queries via the ID parameter in /form137.php. Attackers can potentially read, modify, or delete sensitive student grading data. Organizations using this specific version of the software are affected.
💻 Affected Systems
- SourceCodester Student Grading System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or system takeover via SQL injection escalation techniques
Likely Case
Unauthorized access to student records, grades, and personal information stored in the database
If Mitigated
Limited data exposure if proper input validation and database permissions are configured
🎯 Exploit Status
Exploit details are publicly available on GitHub
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: UNKNOWN
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
Check vendor website for updated version or security advisory
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement parameterized queries or input validation for the ID parameter in /form137.php
Web Application Firewall
allDeploy WAF with SQL injection protection rules
🧯 If You Can't Patch
- Block external access to /form137.php via firewall rules
- Implement database user with minimal permissions
🔍 How to Verify
Check if Vulnerable:
Test /form137.php with SQL injection payloads in ID parameterCheck Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Verify parameterized queries are implemented and SQL injection attempts fail📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts
Network Indicators:
- SQL injection patterns in HTTP requests to /form137.php
SIEM Query:
SELECT * FROM web_logs WHERE url LIKE '%/form137.php%' AND (request LIKE '%UNION%' OR request LIKE '%SELECT%' OR request LIKE '%OR%1=1%')