CVE-2025-15075
📋 TL;DR
CVE-2025-15075 is a SQL injection vulnerability in itsourcecode Student Management System 1.0 that allows remote attackers to execute arbitrary SQL commands via the ID parameter in /student_p.php. This affects all deployments of version 1.0 of this software. Attackers can potentially access, modify, or delete sensitive student data.
💻 Affected Systems
- itsourcecode Student Management System
📦 What is this software?
Student Management System by Angeljudesuarez
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining
Likely Case
Unauthorized access to sensitive student records including personal information, grades, and administrative data
If Mitigated
Limited data exposure if database permissions are properly restricted and input validation is enforced
🎯 Exploit Status
Exploit code is publicly available on GitHub; attack requires no authentication
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://itsourcecode.com/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameterized queries and input validation to /student_p.php
Modify student_p.php to use prepared statements: $stmt = $conn->prepare('SELECT * FROM students WHERE id = ?'); $stmt->bind_param('i', $_GET['ID']);
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns
Add WAF rule: SecRule ARGS:ID "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement network segmentation to limit database access from web servers
🔍 How to Verify
Check if Vulnerable:
Test /student_p.php with SQL injection payloads like: /student_p.php?ID=1' OR '1'='1Check Version:
Check PHP files for version comments or review installation documentationVerify Fix Applied:
Verify that SQL injection payloads no longer work and return proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple failed parameter manipulation attempts on /student_p.php
Network Indicators:
- Unusual database queries originating from web server IP
- SQL syntax in HTTP GET parameters
SIEM Query:
source="web_logs" AND uri="/student_p.php" AND (query="*' OR*" OR query="*UNION*" OR query="*SELECT*FROM*")