Student File Management System
CVE-2025-14621
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated SQL injection, low impacts
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in code-projects Student File Management System 1.0. This affects an unknown part of the file /admin/update_user.php. The manipulation of the argument user_id leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
AnalysisAI
SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the user_id parameter in /admin/update_user.php. Public exploit code is available on GitHub, but the EPSS score (0.05%) indicates low exploitation probability and no active exploitation is confirmed (not in CISA KEV). The vulnerability is easy to exploit but yields only limited data confidentiality, integrity, and availability impacts.
Technical ContextAI
The vulnerability is a classic SQL injection (CWE-74) caused by improper neutralization of special elements used in SQL commands. The affected product, Student File Management System 1.0 (CPE: cpe:2.3:a:fabian:student_file_management_system:1.0:*:*:*:*:*:*:*), directly incorporates user-supplied input from the user_id parameter into a SQL query without sanitization or parameterization. The PHP-based backend executes the crafted query, allowing attackers to execute arbitrary SQL statements against the underlying database.
RemediationAI
No vendor-released patch is available at the time of this analysis. The vendor (code-projects.org) has not issued an official update for version 1.0. As a workaround, implement input validation and parameterized queries for the user_id parameter in /admin/update_user.php. Additionally, restrict network access to the admin panel (e.g., using a firewall or VPN) to minimize exposure. If no security update becomes available, consider migrating to an alternative file management solution with active security support. Note that these workarounds may not eliminate all risk and could affect administrative usability.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today