Student Management System
CVE-2025-15077
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication or user interaction; partial C/I/A impact with no scope change, consistent with a SQLi that exposes or modifies records but does not escalate beyond the application boundary.
Primary rating from NVD.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in itsourcecode Student Management System 1.0. The affected element is an unknown function of the file /form137.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
AnalysisAI
SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /form137.php, potentially reading, modifying, or deleting underlying database records. A public proof-of-concept exploit has been disclosed on GitHub, lowering the barrier to exploitation. Despite the public POC, the EPSS score sits at just 0.05% (15th percentile), consistent with a niche product attracting little automated or opportunistic attack activity.
Technical ContextAI
The affected product is itsourcecode Student Management System version 1.0, a PHP-based web application identified by CPE cpe:2.3:a:angeljudesuarez:student_management_system:1.0:*:*:*:*:*:*:*. The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), manifesting as classic SQL injection: the application passes user-supplied input from the ID parameter in /form137.php directly into a SQL query without parameterization or sufficient sanitization. This allows an attacker to alter the query's logic and interact with the database backend in unintended ways. The CVSS 4.0 vector (E:P) formally annotates the existence of a public exploit.
RemediationAI
No vendor-released patch has been identified at time of analysis. As an immediate compensating control, organizations should restrict network access to /form137.php via web server configuration - for example, applying IP allowlisting or placing the endpoint behind an authenticated reverse proxy - which directly addresses the PR:N, AV:N exploitation path. A web application firewall rule targeting SQL metacharacter injection patterns in the ID parameter can provide an additional detection and blocking layer, though WAF bypass is possible for determined attackers. The definitive fix requires refactoring the affected PHP code to use parameterized queries via PDO or MySQLi prepared statements, eliminating the injection vector at the source. The public POC is available at https://github.com/BUPT424201/CVE/issues/2 and the VulDB entry at https://vuldb.com/?id.338334 for technical reference. No upstream patch version is available to cite.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today