Student File Management System CVE-2025-14663

Exploitation requires three specific conditions: (1) attacker must have high administrative privilege level (PR:H) - e.g., an admin account or a user with admin role; (2) the target administrator must interact with the malicious payload by clicking a link or visiting a crafted URL (UI:P) - passive network access is insufficient; (3) the /admin/update_student.php endpoint must accept unsanitized input in at least one parameter that is reflected or stored. Non-default configurations or hardened deployments with WAF rules blocking script injection patterns would prevent exploitation. The combination of mandatory authentication and user interaction means this does not affect unauthenticated remote attackers or default deployments accessed over the public internet by non-admin users.

Risk assessment reveals a low-priority vulnerability despite public exploit availability. CVSS score of 1.9 is exceptionally low, reflecting the restrictive attack profile: network accessibility is offset by mandatory high-privilege authentication (PR:H), user interaction requirement (UI:P), and minimal impact (integrity limited to indirect scope, VC:N/VI:L/VA:N). EPSS score of 0.06% (percentile 18%) is significantly lower than typical exploitable flaws, suggesting this vulnerability has not gained traction in exploit kits or automated scanning tools. The combination of high privilege requirement and user interaction effectively limits this to insider threats or social engineering against administrators. Public exploit disclosure does not elevate risk given the restrictive conditions-an attacker would need administrator account access and must trick that admin into clicking a malicious link, making this a low-probability attack chain. Organizations with robust admin access controls and security awareness training face minimal real-world risk.

An attacker with administrator credentials (or who has phished admin credentials) crafts a malicious URL containing JavaScript payload in the parameters of /admin/update_student.php (e.g., a student name field). When the target administrator visits this URL or clicks a link provided by the attacker via email or chat, the script executes in the admin's browser context, potentially stealing session cookies or performing unauthorized student record modifications.