CVE-2025-10596
📋 TL;DR
This CVE describes a SQL injection vulnerability in SourceCodester Online Exam Form Submission 1.0, specifically in the 'usn' parameter of /index.php. Attackers can remotely execute arbitrary SQL commands to potentially access, modify, or delete database contents. Organizations using this software are affected.
💻 Affected Systems
- SourceCodester Online Exam Form Submission
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, or deletion; potential remote code execution if database permissions allow.
Likely Case
Unauthorized access to sensitive exam data, student information, or administrative credentials stored in the database.
If Mitigated
Limited impact with proper input validation and database permission restrictions in place.
🎯 Exploit Status
Public exploit details available; SQL injection is a well-understood attack vector with many automated tools available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries as workaround.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement server-side validation and sanitization of the 'usn' parameter to prevent SQL injection.
Modify /index.php to validate and sanitize user input before database queries
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules to block malicious requests.
🧯 If You Can't Patch
- Isolate the application in a segmented network with restricted database access
- Implement strict input validation and use parameterized queries in the application code
🔍 How to Verify
Check if Vulnerable:
Test the 'usn' parameter in /index.php with SQL injection payloads (e.g., ' OR '1'='1).Check Version:
Check the software version in the application interface or configuration files.Verify Fix Applied:
Verify that SQL injection attempts no longer succeed and that input validation is properly implemented.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts with SQL-like patterns in web server logs
Network Indicators:
- HTTP requests to /index.php with SQL injection payloads in parameters
SIEM Query:
source="web_server" AND uri="/index.php" AND (param="usn" AND value MATCHES "(?i).*(union|select|or|and|'|--|#|;).*")