CVE-2025-14335
📋 TL;DR
CVE-2025-14335 is an SQL injection vulnerability in itsourcecode Student Management System 1.0 that allows remote attackers to execute arbitrary SQL commands via the 'sy' parameter in /new_school_year.php. This affects all deployments of the vulnerable software version. Attackers can potentially access, modify, or delete database content.
💻 Affected Systems
- itsourcecode Student Management System
📦 What is this software?
Student Management System by Angeljudesuarez
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining
Likely Case
Unauthorized database access allowing extraction of sensitive student/administrator data, credential theft, and privilege escalation
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure
🎯 Exploit Status
Exploit details are publicly disclosed on GitHub. SQL injection via URL parameter manipulation is straightforward for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://itsourcecode.com/
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates. Consider implementing input validation and parameterized queries as temporary mitigation.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the 'sy' parameter in /new_school_year.php
# Example ModSecurity rule: SecRule ARGS:sy "@detectSQLi" "id:1001,phase:2,deny,status:403"
Input Validation Filter
allAdd input validation to sanitize the 'sy' parameter before processing
# PHP example: $sy = filter_var($_GET['sy'], FILTER_SANITIZE_STRING);
🧯 If You Can't Patch
- Disable or restrict access to /new_school_year.php via web server configuration or authentication
- Implement network segmentation to isolate the Student Management System from sensitive databases
🔍 How to Verify
Check if Vulnerable:
Test by sending a SQL injection payload to the 'sy' parameter: http://target/new_school_year.php?sy=1' OR '1'='1Check Version:
Check application version in admin panel or readme files. No standard command available.Verify Fix Applied:
Verify that SQL injection payloads no longer execute and return error messages or are properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests to /new_school_year.php with special characters in parameters
- Database query patterns from unexpected sources
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) in URL parameters
- Unusual traffic patterns to the vulnerable endpoint
SIEM Query:
source="web_logs" AND url="/new_school_year.php" AND (param="sy" AND value MATCHES "[';]|UNION|SELECT")