CVE-2025-14537
📋 TL;DR
CVE-2025-14537 is a SQL injection vulnerability in code-projects Class and Exam Timetable Management 1.0 that allows attackers to manipulate database queries through the course_year_section/semester parameter in preview7.php. This affects all users running the vulnerable version of this web application. Remote exploitation is possible without authentication.
💻 Affected Systems
- code-projects Class and Exam Timetable Management
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, modification of timetable data, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and database permissions, though SQL injection attempts would still be logged.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameter validation and sanitization for course_year_section/semester parameter in preview7.php
Edit preview7.php to add: $param = mysqli_real_escape_string($connection, $_GET['course_year_section']);
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns
Add WAF rule: SecRule ARGS_GET "@detectSQLi" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Block access to /preview7.php at network perimeter or web server level
- Implement strict database user permissions with least privilege principle
🔍 How to Verify
Check if Vulnerable:
Test preview7.php with SQL injection payloads: preview7.php?course_year_section=1' OR '1'='1Check Version:
Check application version in admin panel or readme filesVerify Fix Applied:
Test with same payloads and verify no SQL errors or unexpected data returned📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Unusual database queries from web application
Network Indicators:
- HTTP requests to preview7.php with SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/preview7.php" AND (param="*SELECT*" OR param="*UNION*" OR param="*OR*'*'*'*")