CVE-2025-14646
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary SQL commands via the 'stud_id' parameter in the /admin/delete_student.php file in code-projects Student File Management System 1.0. This can lead to unauthorized data access, modification, or deletion. All users running version 1.0 of this software are affected.
💻 Affected Systems
- code-projects Student File Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, and potential server takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized access to student records, grade manipulation, or deletion of critical academic data.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easy to weaponize. The /admin/ path suggests authentication may be required first.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd parameter validation to only accept numeric values for stud_id parameter
Modify /admin/delete_student.php to include: if(!is_numeric($_GET['stud_id'])) { die('Invalid input'); }
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
Add WAF rule: SecRule ARGS:stud_id "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Remove or restrict access to /admin/delete_student.php file
- Implement network segmentation to isolate the vulnerable system from sensitive data
🔍 How to Verify
Check if Vulnerable:
Test the /admin/delete_student.php endpoint with SQL injection payloads like: stud_id=1' OR '1'='1Check Version:
Check software documentation or configuration files for version informationVerify Fix Applied:
Test with the same payloads after implementing fixes - should return error or no database interaction📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by /admin/delete_student.php access
- HTTP requests with SQL keywords in stud_id parameter
Network Indicators:
- Unusual traffic patterns to /admin/delete_student.php
- Requests containing SQL injection patterns
SIEM Query:
source="web_logs" AND uri_path="/admin/delete_student.php" AND (query_string CONTAINS "UNION" OR query_string CONTAINS "SELECT" OR query_string CONTAINS "OR '1'='1'")