CVE-2025-2392
📋 TL;DR
This critical SQL injection vulnerability in code-projects Online Class and Exam Scheduling System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'id' parameter in /pages/activate.php. This can lead to unauthorized data access, modification, or deletion. All users running version 1.0 of this software are affected.
💻 Affected Systems
- code-projects Online Class and Exam Scheduling System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, authentication bypass, and potential remote code execution if database functions allow it.
Likely Case
Unauthorized access to sensitive student/teacher data, grade manipulation, schedule tampering, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or limited data exposure.
🎯 Exploit Status
Exploit details are publicly available on GitHub. SQL injection vulnerabilities are commonly weaponized with automated tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check vendor website for security updates
2. If no patch available, implement workarounds
3. Consider migrating to alternative software
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the 'id' parameter before processing
Modify /pages/activate.php to validate that 'id' parameter contains only numeric characters
Web Application Firewall
allDeploy WAF with SQL injection protection rules
🧯 If You Can't Patch
- Isolate the system behind a reverse proxy with strict input validation
- Implement network segmentation to limit database access from the web server
🔍 How to Verify
Check if Vulnerable:
Test /pages/activate.php with SQL injection payloads in the 'id' parameter (e.g., id=1' OR '1'='1)Check Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection attempts return error messages or are properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple failed parameter validation attempts on /pages/activate.php
Network Indicators:
- HTTP requests to /pages/activate.php with SQL keywords in parameters
- Unusual database query patterns
SIEM Query:
source="web_server" AND uri="/pages/activate.php" AND (param="id" AND value CONTAINS "'" OR value CONTAINS "OR" OR value CONTAINS "UNION")