CVE-2025-10595
📋 TL;DR
This SQL injection vulnerability in SourceCodester Online Student File Management System 1.0 allows attackers to execute arbitrary SQL commands via the user_id parameter in /admin/delete_user.php. The vulnerability affects all deployments of this specific software version and can be exploited remotely without authentication.
💻 Affected Systems
- SourceCodester Online Student File Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, modification, or deletion; potential authentication bypass to gain administrative access; possible remote code execution if database configuration permits.
Likely Case
Unauthorized data access and manipulation of student records, user accounts, and system configuration; potential privilege escalation to administrative control.
If Mitigated
Limited impact if proper input validation and parameterized queries are implemented; database permissions restrict damage to non-critical data.
🎯 Exploit Status
Exploit details publicly disclosed on GitHub; attack can be initiated remotely without authentication via HTTP requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Manually fix by implementing parameterized queries in /admin/delete_user.php and validating user_id input.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation to ensure user_id parameter contains only numeric values
Add PHP validation: if(!is_numeric($_GET['user_id'])) { die('Invalid input'); }
Web Application Firewall Rules
allBlock SQL injection patterns targeting /admin/delete_user.php
WAF rule: deny requests to /admin/delete_user.php containing SQL keywords in parameters
🧯 If You Can't Patch
- Block external access to /admin/ directory via firewall rules
- Implement network segmentation to isolate the vulnerable system
🔍 How to Verify
Check if Vulnerable:
Test /admin/delete_user.php?user_id=1' OR '1'='1 to see if SQL error or unexpected behavior occursCheck Version:
Check system documentation or admin panel for version informationVerify Fix Applied:
Test with same payload; should receive error message or no database interaction📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /admin/delete_user.php with SQL keywords in parameters
- Database error logs showing SQL syntax errors
Network Indicators:
- Unusual database queries originating from web server
- Multiple failed delete attempts with malformed parameters
SIEM Query:
source="web_logs" AND uri="/admin/delete_user.php" AND (param="*'*" OR param="*OR*" OR param="*UNION*" OR param="*SELECT*")