Student Management System CVE-2025-15077

No special conditions are required beyond network reachability of the /form137.php endpoint on a running instance of itsourcecode Student Management System 1.0. The CVSS 4.0 vector confirms PR:N (no authentication required) and UI:N (no user interaction needed), meaning a default installation exposed to any network is sufficient. Exploitation is bounded by the product's niche deployment footprint: only organizations that have deliberately installed this specific PHP application and exposed it to an accessible network interface are at risk. No non-default feature flags, special server configurations, or specific client browsers are required. The primary limiting factor is the rarity of deployment in production environments.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms a network-reachable, low-complexity, unauthenticated attack with no user interaction required - the most permissive exploitation profile. Impact is rated low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), and no scope change to subsequent systems is indicated. Counterbalancing these permissive access metrics is the very low EPSS score (0.05%, 15th percentile), which suggests that despite the public POC, mass or automated exploitation is not occurring - consistent with a narrow-footprint hobbyist application unlikely to be exposed broadly on the internet. KEV status is not confirmed. The realistic priority is high for any institution that has deployed and publicly exposed this specific application, but the aggregate threat surface across the industry is small. No conflicting signals are present; CVSS and EPSS together paint a picture of an easily exploitable but rarely deployed target.

An unauthenticated remote attacker identifies a publicly accessible instance of itsourcecode Student Management System 1.0, then sends a crafted HTTP GET or POST request to /form137.php with a SQL injection payload embedded in the ID parameter (e.g., ID=1' OR '1'='1). The application constructs a SQL query incorporating the unsanitized value, which the database engine executes, potentially returning all student records or enabling blind injection to enumerate the schema. A public POC lowering exploitation effort is available on GitHub.