CVE-2025-15034
📋 TL;DR
CVE-2025-15034 is an SQL injection vulnerability in itsourcecode Student Management System 1.0 that allows remote attackers to execute arbitrary SQL commands via the ID parameter in /record.php. This affects all deployments of this specific software version. Attackers can potentially access, modify, or delete database contents including sensitive student information.
💻 Affected Systems
- itsourcecode Student Management System
📦 What is this software?
Student Management System by Angeljudesuarez
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive student records, grades, personal information, and potential database manipulation.
If Mitigated
Limited impact with proper input validation and database permissions, though SQL injection attempts would still be logged.
🎯 Exploit Status
Exploit code is publicly available on GitHub. The vulnerability requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://itsourcecode.com/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative student management systems or implementing workarounds.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection rules to block malicious requests to /record.php
Input Validation Filter
allImplement server-side input validation to sanitize the ID parameter before processing
🧯 If You Can't Patch
- Isolate the system from internet access and restrict to internal network only
- Implement strict network segmentation and monitor all traffic to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Test /record.php endpoint with SQL injection payloads in ID parameter (e.g., ' OR '1'='1)Check Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts
- Requests to /record.php with SQL keywords in parameters
Network Indicators:
- Unusual outbound database connections
- SQL error messages in HTTP responses
SIEM Query:
source="web_logs" AND uri_path="/record.php" AND (param="ID" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|or|and)")