CVE-2025-15077
📋 TL;DR
This vulnerability allows remote attackers to execute SQL injection attacks against itsourcecode Student Management System 1.0 via the ID parameter in /form137.php. Attackers can potentially access, modify, or delete database content. All users running the vulnerable version are affected.
💻 Affected Systems
- itsourcecode Student Management System
📦 What is this software?
Student Management System by Angeljudesuarez
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, or complete system takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized access to sensitive student data, grade manipulation, or administrative credential theft.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
Public exploit available on GitHub. SQL injection via ID parameter requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://itsourcecode.com/
Restart Required: No
Instructions:
1. Check vendor website for updates. 2. If no patch available, implement workarounds. 3. Consider replacing with alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize ID parameter before processing
Modify /form137.php to validate ID parameter using is_numeric() or prepared statements
Web Application Firewall
allDeploy WAF with SQL injection protection rules
Configure WAF to block SQL injection patterns targeting /form137.php
🧯 If You Can't Patch
- Restrict access to /form137.php using IP whitelisting or authentication
- Implement database user with minimal permissions (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Test /form137.php with SQL injection payloads like ' OR '1'='1 in ID parameterCheck Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Test with same payloads after fixes - should return error or no data📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests to /form137.php with suspicious parameters
Network Indicators:
- HTTP requests to /form137.php containing SQL keywords (SELECT, UNION, etc.)
SIEM Query:
source="web_logs" AND uri="/form137.php" AND (query="*SELECT*" OR query="*UNION*" OR query="*OR*1*1*")