CVE-2025-15168
📋 TL;DR
CVE-2025-15168 is an SQL injection vulnerability in itsourcecode Student Management System 1.0 that allows remote attackers to execute arbitrary SQL commands via the ID parameter in /statistical.php. This affects all deployments of version 1.0 of this software. Attackers can potentially read, modify, or delete database contents.
💻 Affected Systems
- itsourcecode Student Management System
📦 What is this software?
Student Management System by Angeljudesuarez
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, and potential remote code execution if database permissions allow.
Likely Case
Unauthorized data access and extraction of sensitive student information, grades, and personal data.
If Mitigated
Limited impact with proper input validation and database permission restrictions in place.
🎯 Exploit Status
Exploit is publicly available on GitHub and requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://itsourcecode.com/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the ID parameter before processing
Modify /statistical.php to validate ID parameter as integer: if(!is_numeric($_GET['ID'])) { die('Invalid input'); }
Web Application Firewall
allDeploy WAF with SQL injection protection rules
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement database-level permissions to limit potential damage
🔍 How to Verify
Check if Vulnerable:
Check if /statistical.php exists and accepts ID parameter without validation. Test with payload: /statistical.php?ID=1' OR '1'='1Check Version:
Check software documentation or about page for version informationVerify Fix Applied:
Test SQL injection attempts return error messages or are blocked. Verify input validation is implemented.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in logs
- Multiple requests to /statistical.php with SQL-like parameters
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) in URL parameters
SIEM Query:
source="web_logs" AND url="*statistical.php*" AND (param="*SELECT*" OR param="*UNION*" OR param="*OR '1'='1*")