CVE-2025-14661
📋 TL;DR
This SQL injection vulnerability in itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'sy' parameter in /advisers.php. This can lead to unauthorized data access, modification, or deletion. Anyone running this specific software version is affected.
💻 Affected Systems
- itsourcecode Student Management System
📦 What is this software?
Student Management System by Angeljudesuarez
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, and potential server takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized access to student records, grades, personal information, and potential data manipulation or deletion.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Public exploit available on GitHub, remote exploitation possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://itsourcecode.com/
Restart Required: No
Instructions:
No official patch available. Implement workarounds or replace with secure alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the 'sy' parameter before processing
Modify /advisers.php to validate 'sy' parameter using regex or type casting
Web Application Firewall Rule
allBlock SQL injection patterns targeting /advisers.php endpoint
Add WAF rule: deny requests to /advisers.php containing SQL keywords in parameters
🧯 If You Can't Patch
- Block external access to /advisers.php endpoint using firewall rules
- Implement network segmentation to isolate the vulnerable system
🔍 How to Verify
Check if Vulnerable:
Test /advisers.php endpoint with SQL injection payloads in 'sy' parameterCheck Version:
Check system documentation or about page for version informationVerify Fix Applied:
Verify input validation prevents SQL injection attempts and returns proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed login attempts via /advisers.php
- Unexpected database queries
Network Indicators:
- HTTP requests to /advisers.php containing SQL keywords like UNION, SELECT, INSERT
SIEM Query:
source="web_logs" AND uri="/advisers.php" AND (param="sy" AND value CONTAINS "' OR '")