CVE-2025-10479
📋 TL;DR
CVE-2025-10479 is an SQL injection vulnerability in SourceCodester Online Student File Management System 1.0 that allows remote attackers to execute arbitrary SQL commands via the stud_no parameter in /index.php. This affects all deployments of version 1.0, potentially compromising student data and system integrity.
💻 Affected Systems
- SourceCodester Online Student File Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, authentication bypass, and potential remote code execution via database functions.
Likely Case
Unauthorized access to student records, grade manipulation, personal information theft, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only read access to non-sensitive data.
🎯 Exploit Status
Exploit code is publicly available on GitHub. Attack requires no authentication and uses simple SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
1. Check vendor website for updated version. 2. If no patch available, implement workarounds. 3. Consider replacing with alternative software.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF with SQL injection rules to block malicious requests
Input Validation Filter
allAdd input validation to sanitize stud_no parameter before processing
// PHP example: $stud_no = mysqli_real_escape_string($connection, $_GET['stud_no']);
🧯 If You Can't Patch
- Isolate the system behind a reverse proxy with strict input validation
- Implement network segmentation to limit database access from web server
🔍 How to Verify
Check if Vulnerable:
Test /index.php with SQL injection payloads in stud_no parameter (e.g., ' OR '1'='1)Check Version:
Check system version in admin panel or readme filesVerify Fix Applied:
Verify parameter sanitization and test with SQL injection payloads that should be rejected📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed login attempts with SQL syntax
- Requests with SQL keywords in stud_no parameter
Network Indicators:
- HTTP requests containing SQL injection patterns in URL parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND (url="*stud_no=*sql*" OR url="*stud_no=*union*" OR url="*stud_no=*select*")