CVE-2025-15205
📋 TL;DR
CVE-2025-15205 is an SQL injection vulnerability in code-projects Student File Management System 1.0 affecting the /download.php file via the istore_id parameter. This allows remote attackers to execute arbitrary SQL commands on the database. Organizations using this specific software version are affected.
💻 Affected Systems
- code-projects Student File Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized database access allowing extraction of sensitive student data, file information, and potentially administrative credentials.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-sensitive data.
🎯 Exploit Status
Public exploit available on GitHub, making this easily weaponizable by attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameter validation and sanitization for istore_id parameter in download.php
Edit download.php to add: $istore_id = intval($_GET['istore_id']); // Convert to integer
Web Application Firewall (WAF) Rules
allDeploy WAF rules to block SQL injection patterns targeting /download.php
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement database-level protections: use least privilege accounts, enable query logging
🔍 How to Verify
Check if Vulnerable:
Test /download.php?istore_id=1' OR '1'='1 to see if SQL error occursCheck Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Test with same payload after implementing fixes - should return normal response or error page📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in web server logs
- Multiple requests to /download.php with SQL patterns
Network Indicators:
- HTTP requests containing SQL keywords targeting /download.php
SIEM Query:
source="web_logs" AND uri="/download.php" AND (request CONTAINS "UNION" OR request CONTAINS "SELECT" OR request CONTAINS "' OR '")