CVE-2025-9664
📋 TL;DR
CVE-2025-9664 is an SQL injection vulnerability in Simple Grading System 1.0's admin panel that allows attackers to manipulate database queries through the /add_student_grade.php endpoint. This affects all organizations using Simple Grading System 1.0 with the vulnerable component exposed. Attackers can potentially access, modify, or delete sensitive student and administrative data.
💻 Affected Systems
- Simple Grading System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection escalation techniques.
Likely Case
Unauthorized access to student records, grade manipulation, or extraction of sensitive administrative credentials from the database.
If Mitigated
Limited impact if proper input validation and parameterized queries are implemented, restricting attackers to read-only access of non-sensitive data.
🎯 Exploit Status
Exploit requires admin panel access; SQL injection is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to a supported alternative or implementing custom fixes.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and parameterized queries in /add_student_grade.php
Edit PHP file to use prepared statements with PDO or mysqli
Web Application Firewall
allDeploy WAF with SQL injection rules to block malicious requests
Configure WAF rules to block SQL injection patterns
🧯 If You Can't Patch
- Isolate the Simple Grading System behind a VPN or internal network only
- Implement strict access controls and monitor admin panel activity logs
🔍 How to Verify
Check if Vulnerable:
Test /add_student_grade.php endpoint with SQL injection payloads in the 'Add' parameterCheck Version:
Check system documentation or configuration files for version informationVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed login attempts to admin panel
- Unexpected database access patterns
Network Indicators:
- HTTP requests to /add_student_grade.php with SQL keywords in parameters
- Unusual outbound database connections
SIEM Query:
source="web_logs" AND uri="/add_student_grade.php" AND (param="Add" AND value CONTAINS "UNION" OR "SELECT" OR "INSERT" OR "DELETE")