Student Management System
CVE-2025-14335
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network attack, low complexity, no privileges or interaction required, and only limited impact on confidentiality, integrity, and availability.
Primary rating from NVD.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /new_school_year.php. The manipulation of the argument sy leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
SQL injection vulnerability in itsourcecode Student Management System version 1.0 allows remote attackers to manipulate database queries via the sy parameter in /new_school_year.php. Exploit code is publicly available, though no active exploitation has been confirmed by CISA KEV. The low EPSS score (0.05%) suggests limited exploitability in practice.
Technical ContextAI
The vulnerability resides in a PHP web application where user-supplied input to the sy parameter is improperly neutralized before being used in a SQL query, falling under CWE-74. The affected product is identified by CPE cpe:2.3:a:angeljudesuarez:student_management_system:1.0:*:*:*:*:*:*:*, a niche project hosted on itsourcecode. The attack vector is via the /new_school_year.php endpoint, which likely handles school year creation, and the lack of parameterized queries permits classic SQL injection.
RemediationAI
No official vendor patch has been identified for this vulnerability. As an immediate workaround, developers should sanitize the sy parameter using parameterized queries or prepared statements in /new_school_year.php. Input validation (e.g., allowing only expected characters) can reduce risk. Access to the affected endpoint should be restricted to authenticated and authorized users only, but this does not fully eliminate SQL injection threats from internal actors. Consider migrating away from unmaintained software in the long term.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today