What is the CVSS score of CVE-2025-5625?

CVE-2025-5625 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-5625?

A publicly disclosed SQL injection vulnerability in the Campcodes Online Teacher Record Management System allows attackers to remotely compromise the application database without requiring…

Is there a public PoC exploit available for CVE-2025-5625?

Yes, a public proof-of-concept exploit is available for CVE-2025-5625. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5625?

Within 24 hours: Immediately disable or restrict access to the /search-teacher.php endpoint; isolate affected systems from production networks if possible; inventory all instances of this application in your environment. Within 7 days: Deploy Web Application Firewall (WAF) rules to block malicious SQL injection patterns targeting the searchteacher parameter; implement input validation and parameterized queries if internal code modification is possible; conduct database access logs review for suspicious queries. Within 30 days: Evaluate alternative teacher management systems; contact vendor for security patch timeline; consider decommissioning the application if no patch becomes available within 30 days.

PHP CVE-2025-5625

EUVD-2025-16949 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-05 cna@vuldb.com

PHP SQLi Online Teacher Record Management System Campcodes

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:53 euvd

EUVD-2025-16949

Analysis Generated

Mar 14, 2026 - 17:53 vuln.today

PoC Detected

Jun 06, 2025 - 15:16 vuln.today

Public exploit code

CVE Published

Jun 05, 2025 - 01:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in Campcodes Online Teacher Record Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /search-teacher.php. The manipulation of the argument searchteacher leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical SQL injection vulnerability in Campcodes Online Teacher Record Management System version 1.0, specifically in the /search-teacher.php file's 'searchteacher' parameter. An unauthenticated remote attacker can exploit this flaw to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of teacher records. The vulnerability has been publicly disclosed with exploit code available, making active exploitation likely in the wild.

Technical ContextAI

This vulnerability stems from improper input validation and parameterization in PHP application code (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component). The /search-teacher.php endpoint accepts user-supplied input via the 'searchteacher' parameter and directly incorporates it into SQL queries without proper escaping or prepared statement usage. The affected product is Campcodes Online Teacher Record Management System 1.0, a PHP-based web application designed for educational institution record management. The root cause is a classic first-order SQL injection where untrusted user input flows directly into SQL command construction, likely using string concatenation rather than parameterized queries or ORM frameworks with proper query binding.

RemediationAI

Immediate remediation steps: (1) If available, upgrade Campcodes Online Teacher Record Management System to a patched version beyond 1.0 (vendor patch status unknown from provided data—contact Campcodes directly or check their official advisories); (2) As a temporary mitigation, implement Web Application Firewall (WAF) rules to detect and block SQL injection payloads in the 'searchteacher' parameter (signature: common SQL keywords like UNION, SELECT, OR, DROP in parameter values); (3) Disable or restrict network access to the /search-teacher.php endpoint using network segmentation or IP whitelisting until patching is possible; (4) Implement input validation on the 'searchteacher' parameter using a whitelist approach (alphanumeric characters only if the search use case permits); (5) Enable database query logging and monitor for suspicious SQL patterns; (6) If source code is available, refactor the search functionality to use parameterized queries (prepared statements) with bound parameters rather than string concatenation. Contact Campcodes support for official patch status and timeline.