Online-School CVE-2025-12277
MEDIUMSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible login page requires no authentication or user interaction; SQL injection yields limited low CIA impact bounded by database account permissions with no scope change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in Abdullah-Hasan-Sajjad Online-School up to f09dda77b4c29aa083ff57f4b1eb991b98b68883. This affects an unknown part of the file /studentLogin.php. This manipulation of the argument Email causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in Abdullah-Hasan-Sajjad's Online-School PHP application allows remote unauthenticated attackers to manipulate database queries through the Email parameter in the student login endpoint. All versions up to commit f09dda77b4c29aa083ff57f4b1eb991b98b68883 are affected, with a publicly available exploit report published via GitHub. The vendor was contacted prior to disclosure but did not respond, meaning no patch exists and the application remains unpatched.
Technical ContextAI
Online-School is an open-source PHP-based school management application maintained by Abdullah-Hasan-Sajjad on GitHub, following a rolling release strategy with no fixed versioning. The vulnerability stems from CWE-74 (Injection), specifically SQL injection, where the Email parameter in /studentLogin.php is passed unsanitized to a backend database query. This indicates the absence of parameterized queries or prepared statements in the login logic - a foundational secure coding failure. No CPE string was provided in the source data; the affected scope is bounded by the referenced commit hash rather than a named version.
Affected ProductsAI
Abdullah-Hasan-Sajjad's Online-School PHP application is affected in all versions up to and including commit f09dda77b4c29aa083ff57f4b1eb991b98b68883. The project uses a rolling release strategy with no fixed version numbers, making commit hash the primary version identifier. No CPE string was provided in source data. No vendor advisory exists as the maintainer did not respond to disclosure. The exploit report is documented at https://github.com/DaoYunXinShang/Reports/blob/main/sql%20injection.doc and the VulDB disclosure is at https://vuldb.com/?id.329948.
RemediationAI
No vendor-released patch is identified at time of analysis - the vendor was contacted prior to disclosure but provided no response. Organizations running this application should immediately replace unsanitized direct string interpolation in the Email parameter handling within /studentLogin.php with parameterized queries or PDO prepared statements; this is the only definitive fix. As a compensating control, deploying a web application firewall (WAF) rule to block common SQL injection patterns (single quotes, SQL keywords such as OR/UNION/SELECT) in the login email field can reduce exploitation likelihood, though WAF bypass techniques exist and this is not a substitute for code-level remediation. If the login page is not required to be publicly accessible, restricting it to trusted IP ranges via server configuration is an effective mitigating control with the trade-off of restricting legitimate remote access. Given the vendor's non-response, migration to an actively maintained alternative should be considered for production deployments.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today