CVE-2025-10613
📋 TL;DR
This SQL injection vulnerability in itsourcecode Student Information System 1.0 allows attackers to manipulate database queries through the level_id parameter in /leveledit1.php. Attackers can potentially read, modify, or delete sensitive student data. Organizations using this software are affected.
💻 Affected Systems
- itsourcecode Student Information System
📦 What is this software?
Student Information System by Facebook Julykringcadayona
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE escalation.
Likely Case
Unauthorized access to sensitive student information (grades, personal data) and potential database manipulation.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploit details are publicly available on GitHub. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch exists. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
PHPImplement strict input validation and parameterized queries for the level_id parameter in /leveledit1.php
Modify /leveledit1.php to use prepared statements: $stmt = $conn->prepare('SELECT * FROM levels WHERE id = ?'); $stmt->bind_param('i', $level_id);
Web Application Firewall Rules
allDeploy WAF rules to block SQL injection patterns targeting /leveledit1.php
Add WAF rule: Block requests to /leveledit1.php containing SQL keywords in level_id parameter
🧯 If You Can't Patch
- Block external access to /leveledit1.php using firewall rules or web server configuration
- Implement network segmentation to isolate the Student Information System from sensitive networks
🔍 How to Verify
Check if Vulnerable:
Test /leveledit1.php with SQL injection payloads in level_id parameter (e.g., level_id=1' OR '1'='1)Check Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from /leveledit1.php
- SQL syntax errors in application logs
- Multiple failed login attempts following SQL injection patterns
Network Indicators:
- HTTP requests to /leveledit1.php with SQL keywords in parameters
- Unusual database traffic patterns
SIEM Query:
source="web_logs" AND uri_path="/leveledit1.php" AND (query_string="*UNION*" OR query_string="*SELECT*" OR query_string="*OR*1=1*")