Which versions of PHP are affected by CVE-2025-5977?

A publicly disclosed SQL injection vulnerability in the School Fees Payment System poses a critical risk to any organization using this software, enabling attackers to access, modify, or exfiltrate…

Is there a public PoC exploit available for CVE-2025-5977?

Yes, a public proof-of-concept exploit is available for CVE-2025-5977. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5977?

Within 24 hours: Identify all instances of School Fees Payment System 1.0 in production and isolate or disable access to the /datatable.php endpoint if operationally feasible. Within 7 days: Deploy Web Application Firewall (WAF) rules to block malicious sSortDir_0 parameter values, implement input validation at the application layer, and conduct a forensic review of database logs for evidence of exploitation. Within 30 days: Evaluate vendor communication on patch timelines and patch availability; if no patch is provided, plan migration to an alternative payment processing solution or implement compensating controls including database read-only replicas for sensitive tables and strict network segmentation.

PHP CVE-2025-5977

Q: What is the CVSS score of CVE-2025-5977?

CVE-2025-5977 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-17818 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-10 cna@vuldb.com

PHP SQLi School Fees Payment System Fabian

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17818

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

PoC Detected

Jun 17, 2025 - 20:34 vuln.today

Public exploit code

CVE Published

Jun 10, 2025 - 20:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects School Fees Payment System 1.0 and classified as critical. This issue affects some unknown processing of the file /datatable.php. The manipulation of the argument sSortDir_0 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical SQL injection vulnerability in code-projects School Fees Payment System version 1.0, specifically in the /datatable.php file where the sSortDir_0 parameter is improperly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the underlying database. The vulnerability has been publicly disclosed with exploit code available, indicating active exploitation risk.

Technical ContextAI

The vulnerability exists in a PHP-based web application (School Fees Payment System) that uses DataTables or similar JavaScript library for server-side data rendering. The sSortDir_0 parameter is a sorting direction argument commonly used in DataTables AJAX requests. The root cause is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which reflects insufficient input validation and parameterized query usage. The /datatable.php endpoint directly concatenates user-supplied sorting parameters into SQL queries without proper escaping, type casting, or prepared statement implementation. This is a classic second-order injection scenario where user input flows directly into database commands via dynamic query construction.

RemediationAI

Immediate actions: (1) Apply vendor patches - contact code-projects for security updates or migrate to patched version if available. (2) Implement Web Application Firewall (WAF) rules to block requests with SQL metacharacters in sSortDir_0 parameter (validate against whitelist: ASC or DESC only). (3) Code-level fix: Replace dynamic query construction with prepared statements using parameterized queries in /datatable.php - validate sSortDir_0 against strict whitelist of 'ASC' or 'DESC' values only before SQL incorporation. (4) Disable DataTables server-side processing if not required; use client-side sorting instead. (5) Implement strict input validation: sSortDir_0 must match regex ^(ASC|DESC)$ case-insensitively. (6) Apply principle of least privilege - database user running PHP application should have SELECT-only permissions, preventing INSERT/UPDATE/DELETE via injection. (7) Monitor database logs for suspicious queries with UNION, SLEEP(), or CAST operators.