CVE-2025-5977
📋 TL;DR
This critical SQL injection vulnerability in code-projects School Fees Payment System 1.0 allows remote attackers to execute arbitrary SQL commands via the sSortDir_0 parameter in /datatable.php. This can lead to unauthorized data access, modification, or deletion. All users running version 1.0 are affected.
💻 Affected Systems
- code-projects School Fees Payment System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive student/financial data theft, system takeover via RCE if database permissions allow, and potential lateral movement to other systems.
Likely Case
Data exfiltration of student records, financial data, and administrative credentials; potential database corruption or deletion.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub. Simple HTTP requests with SQL injection payloads can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check vendor website for security updates. 2. If no patch available, implement workarounds immediately. 3. Consider migrating to alternative software if vendor is unresponsive.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allBlock SQL injection patterns targeting /datatable.php and sSortDir_0 parameter
Input Validation Filter
allAdd server-side validation to restrict sSortDir_0 parameter to expected values only
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement network segmentation to limit database access from the application server
🔍 How to Verify
Check if Vulnerable:
Test by sending SQL injection payloads to /datatable.php with sSortDir_0 parameter. Example: GET /datatable.php?sSortDir_0=' OR '1'='1Check Version:
Check application files or documentation for version informationVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return error messages or are properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests to /datatable.php with suspicious parameters
- Error messages containing SQL syntax
Network Indicators:
- HTTP requests to /datatable.php with SQL keywords in parameters
- Unusual outbound database connections from web server
SIEM Query:
source="web_logs" AND uri="/datatable.php" AND (param="sSortDir_0" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|exec|--|#)")