Online Teacher Record Management System CVE-2025-5675

This vulnerability presents elevated real-world risk despite the CVSS score of 7.3 (High, not Critical). Risk signal analysis: (1) CVSS Vector indicates Network-based attack with Low complexity, requiring No privileges and No user interaction—highly favorable for attackers; (2) Public disclosure with available POC significantly increases exploitation probability and reduces barrier-to-entry for threat actors; (3) The authentication bypass (PR:N) is critical for administrative functionality, suggesting the vulnerable endpoint may be directly accessible; (4) SQL injection impact (Confidentiality, Integrity, Availability all affected) can lead to complete database compromise; (5) Educational institutions operating teacher record systems are high-value targets for data theft, regulatory violations, and operational disruption. The primary mitigating factor is the requirement for specific knowledge of the vulnerable endpoint path, which is partially offset by public disclosure. EPSS probability is likely elevated (>40%) given public POC availability. This should be treated as a priority-1 remediation item for all affected deployments.

A threat actor discovers the public POC for CVE-2025-5675 and identifies a school district using Campcodes OTMS. The attacker navigates to the vulnerable endpoint without authentication and injects a SQL payload in the fromdate parameter: ?fromdate=2025-01-01' UNION SELECT username,password,email FROM admin_users--&todate=2025-12-31. The unvalidated input is directly concatenated into the backend SQL query, allowing the UNION-based injection to extract administrative credentials. The attacker uses stolen credentials to access the administrative panel, exfiltrates sensitive student and teacher records (PII), and modifies grade records to disrupt operations. The low attack complexity and public POC reduce the technical barrier, making this accessible to even unsophisticated threat actors targeting educational institutions.