Class and Exam Timetable Management CVE-2025-14537
MEDIUMSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-based, low complexity, no privileges required, limited impact on confidentiality, integrity, and availability.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in code-projects Class and Exam Timetable Management 1.0. Affected by this issue is some unknown functionality of the file /preview7.php. This manipulation of the argument course_year_section/semester causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
AnalysisAI
SQL injection in code-projects Class and Exam Timetable Management 1.0 allows remote attackers to manipulate database queries. The vulnerability resides in the /preview7.php endpoint, where the course_year_section or semester parameter can be abused without authentication. Public exploit code is available, but no evidence of active exploitation in the wild or CISA KEV listing exists.
Technical ContextAI
This is a classic SQL injection (CWE-89, although listed as CWE-74) in a PHP web application. The affected product, identified as CPE cpe:2.3:a:fabian:class_and_exam_timetable_management_system:1.0, handles course and exam scheduling. The flaw arises from improper sanitisation of user-supplied input in the course_year_section/semester parameters within /preview7.php, allowing an attacker to inject arbitrary SQL commands into the backend database query.
RemediationAI
No vendor-released patch exists for this unmaintained academic project. As a workaround, remove public access to the /preview7.php endpoint (e.g., via web server configuration or .htaccess rules) or deploy a web application firewall (WAF) rule to filter SQL injection attempts on the course_year_section and semester parameters. If the application must remain online, apply strict input validation and parameterised queries at the code level. Note that these compensating controls may break legitimate functionality if not carefully tuned. Migrating to a supported, actively maintained alternative is strongly recommended.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today