CVE-2025-14337
📋 TL;DR
CVE-2025-14337 is a SQL injection vulnerability in itsourcecode Student Management System 1.0 that allows remote attackers to execute arbitrary SQL commands via the 'grade' parameter in /new_grade.php. This can lead to data theft, modification, or deletion. Organizations using this specific software version are affected.
💻 Affected Systems
- itsourcecode Student Management System
📦 What is this software?
Student Management System by Angeljudesuarez
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including student records, grades, personal information, administrative credentials, and potential server takeover via SQL injection escalation.
Likely Case
Unauthorized access to sensitive student data, grade manipulation, and potential data exfiltration.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or failed queries.
🎯 Exploit Status
Public exploit available on GitHub. Remote exploitation requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://itsourcecode.com/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the 'grade' parameter before processing
Modify /new_grade.php to add: $grade = mysqli_real_escape_string($conn, $_POST['grade']);
Web Application Firewall Rule
allBlock SQL injection patterns targeting /new_grade.php
WAF rule: Block requests to /new_grade.php containing SQL keywords in grade parameter
🧯 If You Can't Patch
- Isolate the Student Management System behind a reverse proxy with strict input filtering
- Implement database user with minimal permissions (read-only if possible) for the application
🔍 How to Verify
Check if Vulnerable:
Test /new_grade.php with SQL injection payloads in grade parameter (e.g., grade=1' OR '1'='1)Check Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Verify input validation is implemented and SQL injection attempts return errors or are blocked📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in PHP/MySQL logs
- Unusual database queries from web server IP
- Multiple failed login attempts after exploitation
Network Indicators:
- HTTP POST requests to /new_grade.php with SQL keywords in parameters
- Unusual outbound database connections
SIEM Query:
source="web_logs" AND uri="/new_grade.php" AND (param="grade" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|--|#|;)")