CVE-2025-14663
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into the Student File Management System 1.0 through the /admin/update_student.php endpoint. When exploited, it enables cross-site scripting attacks that can steal session cookies, redirect users, or deface the application. Organizations using code-projects Student File Management System 1.0 are affected.
💻 Affected Systems
- code-projects Student File Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full administrative access to the system, and potentially compromise student data or install backdoors.
Likely Case
Attackers deface the application, redirect users to malicious sites, or steal session cookies of logged-in users.
If Mitigated
With proper input validation and output encoding, the impact is limited to minor UI disruption with no data compromise.
🎯 Exploit Status
Exploit details are publicly disclosed on GitHub and vuldb.com, making weaponization likely.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and output encoding in /admin/update_student.php or disabling the endpoint.
🔧 Temporary Workarounds
Implement Input Validation
allAdd server-side validation to sanitize all user inputs in the update_student.php endpoint.
Edit /admin/update_student.php to include input sanitization functions like htmlspecialchars() or filter_var()
Disable Vulnerable Endpoint
allTemporarily disable or restrict access to /admin/update_student.php if not essential.
Rename /admin/update_student.php to /admin/update_student.php.disabled or modify .htaccess to block access
🧯 If You Can't Patch
- Implement a Web Application Firewall (WAF) with XSS protection rules
- Restrict access to the /admin/ directory to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Test the /admin/update_student.php endpoint with XSS payloads like <script>alert('XSS')</script> and check if it executes in the browser.Check Version:
Check the system documentation or configuration files for version information, typically in README or config files.Verify Fix Applied:
After implementing fixes, retest with XSS payloads to ensure they are properly sanitized and do not execute.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /admin/update_student.php with script tags or JavaScript code
- Multiple failed login attempts followed by XSS payloads
Network Indicators:
- HTTP requests containing <script> tags or JavaScript in parameters sent to the vulnerable endpoint
SIEM Query:
source="web_logs" AND uri="/admin/update_student.php" AND (message="*<script>*" OR message="*javascript:*")