CVE-2025-11601
📋 TL;DR
This SQL injection vulnerability in SourceCodester Online Student Result System 1.0 allows attackers to manipulate database queries through the Username parameter in /login.php. Remote attackers can potentially access, modify, or delete student result data. All deployments of version 1.0 are affected.
💻 Affected Systems
- SourceCodester Online Student Result System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including student records, grades, personal information, and potential system takeover via privilege escalation.
Likely Case
Unauthorized access to student records and grades, data exfiltration, and potential manipulation of academic results.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or failed login attempts visible.
🎯 Exploit Status
Public exploit available on GitHub; SQL injection via login form requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider upgrading to newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Parameterized Queries
allModify login.php to use prepared statements and validate/sanitize Username input
Replace raw SQL queries with PDO or mysqli prepared statements in login.php
Web Application Firewall (WAF) Rules
allDeploy WAF rules to block SQL injection patterns in login requests
Add WAF rule: Detect and block SQL keywords in Username parameter
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement network segmentation and monitor for unusual database queries
🔍 How to Verify
Check if Vulnerable:
Test login.php with SQL injection payloads like ' OR '1'='1 in Username fieldCheck Version:
Check system documentation or admin panel for version informationVerify Fix Applied:
Test with same payloads; should receive generic error or fail authentication without SQL errors📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in web server logs
- Multiple failed login attempts with SQL syntax
- Database query errors containing Username parameter
Network Indicators:
- HTTP POST requests to /login.php with SQL keywords in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/login.php" AND (message="sql" OR message="syntax" OR message="database")