CVE-2025-14940
📋 TL;DR
This SQL injection vulnerability in Scholars Tracking System 1.0 allows attackers to execute arbitrary SQL commands via the ID parameter in /admin/delete_user.php. Attackers can potentially access, modify, or delete database content remotely. All users running the affected software version are vulnerable.
💻 Affected Systems
- Scholars Tracking System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, privilege escalation to admin, and potential server takeover via SQL injection chaining.
Likely Case
Unauthorized access to sensitive student/faculty data, modification of academic records, or deletion of user accounts.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
Exploit requires access to admin interface but SQL injection is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check vendor website for updates 2. Apply parameterized queries to /admin/delete_user.php 3. Validate and sanitize ID parameter input
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to only accept numeric IDs
Add PHP validation: if(!is_numeric($_GET['ID'])) { die('Invalid input'); }
Access Restriction
linuxRestrict access to admin panel via IP whitelisting or additional authentication
Add .htaccess: Order deny,allow
Deny from all
Allow from 192.168.1.0/24
🧯 If You Can't Patch
- Implement WAF rules to block SQL injection patterns targeting delete_user.php
- Restrict database user permissions to minimum required (no DROP, no UNION queries)
🔍 How to Verify
Check if Vulnerable:
Test /admin/delete_user.php?ID=1' OR '1'='1 and observe SQL errors or unexpected behaviorCheck Version:
Check system documentation or admin panel footer for version informationVerify Fix Applied:
Test with SQL injection payloads and confirm proper error handling or rejection📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Multiple failed delete_user.php requests with special characters
- Unusual database queries from web application user
Network Indicators:
- HTTP requests to delete_user.php with SQL keywords in parameters
- Abnormal database response sizes
SIEM Query:
source="web_logs" AND uri="/admin/delete_user.php" AND (param="*'*" OR param="*OR*" OR param="*UNION*" OR param="*SELECT*")