CVE-2025-14334
📋 TL;DR
CVE-2025-14334 is a SQL injection vulnerability in itsourcecode Student Management System 1.0 that allows attackers to execute arbitrary SQL commands via the Name parameter in /new_adviser.php. This can lead to unauthorized data access, modification, or deletion. Organizations using this specific software version are affected.
💻 Affected Systems
- itsourcecode Student Management System
📦 What is this software?
Student Management System by Angeljudesuarez
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, or full system takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized access to sensitive student data, grade manipulation, or administrative account takeover.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://itsourcecode.com/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the Name parameter before processing
Modify /new_adviser.php to include: $name = mysqli_real_escape_string($connection, $_POST['Name']);
Web Application Firewall Rule
allBlock SQL injection patterns targeting /new_adviser.php
Add WAF rule: SecRule REQUEST_URI "@contains /new_adviser.php" "id:1001,phase:2,deny,status:403,msg:'Blocking SQLi attempt'"
SecRule ARGS:Name "@detectSQLi"
🧯 If You Can't Patch
- Restrict network access to the Student Management System using firewall rules
- Implement database user with minimal permissions (read-only where possible)
🔍 How to Verify
Check if Vulnerable:
Test the /new_adviser.php endpoint with SQL injection payloads like: Name=admin' OR '1'='1Check Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Retest with SQL injection payloads after implementing workarounds; successful payloads should be blocked or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts via /new_adviser.php
- SQL syntax errors in web server logs
Network Indicators:
- HTTP POST requests to /new_adviser.php containing SQL keywords (UNION, SELECT, etc.)
- Unusual traffic patterns to the vulnerable endpoint
SIEM Query:
source="web_logs" AND uri="/new_adviser.php" AND (request_body CONTAINS "' OR" OR request_body CONTAINS "UNION SELECT")