CVE-2025-14653
📋 TL;DR
CVE-2025-14653 is an SQL injection vulnerability in itsourcecode Student Management System 1.0 that allows attackers to manipulate database queries through the /addrecord.php endpoint. This enables unauthorized data access, modification, or deletion. All users running the vulnerable version are affected.
💻 Affected Systems
- itsourcecode Student Management System
📦 What is this software?
Student Management System by Angeljudesuarez
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, or full system takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized access to student records, grade manipulation, or extraction of sensitive information from the database.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://itsourcecode.com/
Restart Required: No
Instructions:
No official patch available. Consider migrating to a different student management system or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and parameterized queries for the ID parameter in addrecord.php
Modify addrecord.php to use prepared statements: $stmt = $conn->prepare('SELECT * FROM table WHERE id = ?'); $stmt->bind_param('i', $id);
Web Application Firewall Rules
allDeploy WAF rules to block SQL injection patterns targeting /addrecord.php
Add WAF rule: Block requests to /addrecord.php containing SQL keywords like UNION, SELECT, INSERT, DELETE, DROP, OR 1=1
🧯 If You Can't Patch
- Isolate the Student Management System behind a reverse proxy with strict input filtering
- Implement network segmentation to restrict database access from the web application server
🔍 How to Verify
Check if Vulnerable:
Test the /addrecord.php endpoint with SQL injection payloads like ' OR '1'='1 in the ID parameterCheck Version:
Check the system documentation or about page for version informationVerify Fix Applied:
Attempt SQL injection tests after implementing parameterized queries and verify they are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed login attempts or parameter manipulation in access logs
Network Indicators:
- Unusual database queries from web server IP
- SQL keywords in URL parameters to /addrecord.php
SIEM Query:
source="web_logs" AND url="/addrecord.php" AND (param="*UNION*" OR param="*SELECT*" OR param="*OR 1=1*")