Scholars Tracking System
CVE-2025-14940
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, no authentication required, and limited SQL injection impact as per CVSS 4.0 low metrics.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in code-projects Scholars Tracking System 1.0. The affected element is an unknown function of the file /admin/delete_user.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
AnalysisAI
SQL injection in Scholars Tracking System 1.0 allows remote unauthenticated attackers to manipulate the ID parameter in /admin/delete_user.php. The vulnerability enables limited modification or deletion of database records. A public proof-of-concept exploit exists, but no active exploitation in the wild has been confirmed.
Technical ContextAI
The vulnerability resides in a PHP-based web application. The script /admin/delete_user.php fails to properly sanitize the user-supplied ID parameter before using it in an SQL query, leading to CWE-74 (improper neutralization of special elements in output used by a downstream component). This classic SQL injection flaw allows attackers to inject arbitrary SQL fragments, potentially reading, modifying, or deleting database content, though the impact metric indicates limited effect (low confidentiality, integrity, and availability impact). The affected product is identified by CPE cpe:2.3:a:fabian:scholars_tracking_system:1.0.
RemediationAI
No vendor-released patch is available. As a compensating control, restrict network access to the /admin/delete_user.php endpoint using web server rules (e.g., .htaccess or IP whitelisting) to block all untrusted sources. Alternatively, deploy a Web Application Firewall (WAF) rule to filter SQL injection attempts targeting the ID parameter. If feasible, temporarily disable the delete_user.php script until the code is fixed. Side effects: IP whitelisting may break legitimate administrative access from dynamic IPs; WAF rules may cause false positives.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today