CVE-2025-14566
📋 TL;DR
This CVE describes a SQL injection vulnerability in kidaze CourseSelectionSystem that allows remote attackers to execute arbitrary SQL commands via the USN parameter in /Profilers/SProfile/reg.php. All users running vulnerable versions of this software are affected. The vulnerability is remotely exploitable and a public exploit exists.
💻 Affected Systems
- kidaze CourseSelectionSystem
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution if database permissions allow.
Likely Case
Unauthorized data access, data modification, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploit code is publicly available and the vulnerability requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries as workaround.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and sanitization for the USN parameter in reg.php
Web Application Firewall Rules
allDeploy WAF rules to block SQL injection patterns targeting the USN parameter
🧯 If You Can't Patch
- Implement network segmentation to restrict access to vulnerable systems
- Deploy intrusion detection systems to monitor for SQL injection attempts
🔍 How to Verify
Check if Vulnerable:
Check if your version commit hash is 42cd892b40a18d50bd4ed1905fa89f939173a464 or earlierCheck Version:
Check git commit history or version files in the application directoryVerify Fix Applied:
Test the USN parameter with SQL injection payloads to verify proper input validation📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed login attempts via USN parameter
- SQL syntax errors in error logs
Network Indicators:
- HTTP requests with SQL injection payloads in USN parameter
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND (url="/Profilers/SProfile/reg.php" AND (query="*USN=*" AND (query="*' OR *" OR query="*;--*" OR query="*UNION*")))