CVE-2025-14336
📋 TL;DR
This vulnerability allows remote attackers to execute SQL injection attacks against the itsourcecode Student Management System 1.0 via the 'sy' parameter in the /promote.php file. Attackers can potentially access, modify, or delete database content. All users running the vulnerable version are affected.
💻 Affected Systems
- itsourcecode Student Management System
📦 What is this software?
Student Management System by Angeljudesuarez
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, or complete system takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized access to sensitive student data, grade manipulation, or administrative credential theft.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
The exploit has been made public and requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://itsourcecode.com/
Restart Required: No
Instructions:
No official patch available. Consider implementing workarounds or replacing the software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the 'sy' parameter before processing
Modify promote.php to add: $sy = mysqli_real_escape_string($connection, $_GET['sy']);
Web Application Firewall Rule
allBlock SQL injection patterns targeting the /promote.php endpoint
Add WAF rule: deny requests to /promote.php containing SQL keywords in parameters
🧯 If You Can't Patch
- Restrict network access to the Student Management System to trusted IPs only
- Implement database user with minimal privileges and enable query logging
🔍 How to Verify
Check if Vulnerable:
Test /promote.php with SQL injection payloads in the 'sy' parameter (e.g., sy=1' OR '1'='1)Check Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return proper error handling📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Unusual database queries from web application user
- Multiple failed login attempts after promote.php access
Network Indicators:
- HTTP requests to /promote.php with SQL keywords in parameters
- Unusual outbound database connections from web server
SIEM Query:
source="web_logs" AND uri="/promote.php" AND (param="sy" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|or|and)")