CVE-2025-11343
📋 TL;DR
This vulnerability allows unauthenticated SQL injection in the Student Crud Operation 3.3 software via the delete.php file. Attackers can manipulate the ID parameter to execute arbitrary SQL commands, potentially leading to data deletion, modification, or extraction. Any organization using this specific version of the PHP application is affected.
💻 Affected Systems
- Student Crud Operation
📦 What is this software?
Crud Operation System by Code Projects
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data deletion, exfiltration of sensitive student information, and potential server takeover via SQL injection escalation.
Likely Case
Mass deletion of student records and unauthorized access to database contents.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Public exploit documentation exists showing mass deletion capability. Simple HTTP requests can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check vendor website for updates. 2. If no patch available, implement workarounds. 3. Manually fix delete.php by implementing parameterized queries.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to delete.php to only accept numeric IDs
Add to delete.php: if(!is_numeric($_GET['ID'])) { die('Invalid input'); }
Web Application Firewall Rule
allBlock SQL injection patterns targeting delete.php
WAF specific - configure to block SQL patterns in URL parameters
🧯 If You Can't Patch
- Restrict network access to the application using firewall rules
- Implement database user with minimal permissions (read-only where possible)
🔍 How to Verify
Check if Vulnerable:
Test delete.php with SQL injection payload: delete.php?ID=1' OR '1'='1Check Version:
Check application files for version markers or readme.txtVerify Fix Applied:
Test with same payload after fix - should return error or no database modification📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple DELETE operations from single IP
- Requests to delete.php with non-numeric ID parameters
Network Indicators:
- HTTP requests to delete.php containing SQL keywords (UNION, SELECT, DELETE)
- Unusual database traffic patterns
SIEM Query:
source="web_logs" AND uri="*delete.php*" AND (query="*UNION*" OR query="*SELECT*" OR query="*OR*1*" OR query="*'*'*'")🔗 References
- https://code-projects.org/
- https://github.com/romatdibrohiksnov/vulndb.com/blob/main/Student%20Crud%20Operation%20In%20PHP%20Unauthenticated%20SQL%20Injection%20allows%20mass%20deletion%20in%20delete.php.md
- https://vuldb.com/?ctiid.327228
- https://vuldb.com/?id.327228
- https://vuldb.com/?submit.664870
- https://github.com/romatdibrohiksnov/vulndb.com/blob/main/Student%20Crud%20Operation%20In%20PHP%20Unauthenticated%20SQL%20Injection%20allows%20mass%20deletion%20in%20delete.php.md
