Computer Laboratory System
CVE-2025-60307
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed login page
-
DeliverySubmit universal password in Password field
-
ExploitInjected SQL forces auth check true
-
ExecutionBypass login as valid user
-
ImpactAccess application data and functions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The only prerequisite is network reachability to the application's login page - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, no-user-interaction exploitation against a default installation. The specific attack surface is the Password field on the login form, into which a 'universal password' SQL injection payload is entered to bypass the authentication check. Limiting factors are practical rather than technical: the affected software is Computer Laboratory System 1.0 specifically, which is a low-prevalence academic demo, so realistic exposure depends on an organization actually deploying this product and exposing its login page to the attacker's network. |
| Impact | The signals conflict in a way defenders should weigh carefully. The CVSS 3.1 base vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) reflects trivial, remote, unauthenticated exploitation with full compromise of the application context, and public PoC code raises the practical ease of attack. However, EPSS is only 0.42% (34th percentile) and the CVE is not listed in CISA KEV, so there is no evidence of widespread or active exploitation - consistent with the product being an obscure, low-deployment academic project rather than enterprise software. The 9.8 rating is technically accurate for the flaw itself but overstates real-world organizational risk for most environments: this is a genuine, easily exploitable bug in a niche product, so it is a high priority only for the small population actually running Computer Laboratory System 1.0. Note the C:H/A:H assignment is somewhat generous for a pure login-bypass - the confirmed impact is integrity/confidentiality of application data via authenticated access; verify actual availability impact against the PoC. |
| Exploit ScenarioDerived | An attacker locates an internet-exposed Computer Laboratory System 1.0 login page, enters any username (or a known one) and a SQL injection payload as the 'universal password', and is authenticated as a legitimate user without knowing any real credentials. Because public PoC code exists and the attack is network-based with low complexity and no authentication, the exploit can be executed with a single crafted HTTP POST and requires no user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 05, 2026
Authentication bypass via SQL injection in code-projects Computer Laboratory System 1.0 allows a remote unauthenticated attacker to log in as a valid user by submitting a crafted 'universal password' in the login form's Password field. The injected SQL manipulates the login query so the authentication check always evaluates true, granting access without valid credentials. Publicly available exploit code exists (PoC published on GitHub), though the low EPSS score (0.42%, 34th percentile) and absence from CISA KEV indicate no confirmed active exploitation at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis, as this is a source-code demo project without a formal advisory. The primary compensating control is at the code level: replace the vulnerable login query with parameterized/prepared statements (PDO or mysqli bound parameters) so the Password field can never alter query structure, and add server-side input validation. As immediate operational mitigations, restrict network access to the application (place it behind a VPN or IP allowlist rather than exposing the login page to the internet), and deploy a WAF rule to block common SQL metacharacters and tautology patterns on the login endpoint - noting this may cause false positives on legitimate passwords containing quotes or comment sequences. Given the product's demo nature, the most defensible option is to retire it from any production or internet-facing use. Refer to the PoC at https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-60307.md to build detection signatures for the specific payload.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected software is code-projects 'Computer Laboratory System' version 1.0 (CPE cpe:2.3:a:carmelo:computer_laboratory_system:1.0), a small PHP/MySQL web application of the kind distributed as free source-code demos. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input from the Password field is concatenated directly into a SQL query rather than passed as a parameterized value. A classic tautology-based injection (e.g. a payload closing the string and appending an always-true OR condition, or a comment sequence to truncate the query) causes the WHERE clause of the authentication SELECT to match a row regardless of the actual stored password, producing the 'universal password' login bypass described.
Know when Computer Laboratory System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated login bypass via the Password field gives low-complexity full data access (C:H/I:H); availability impact is not evidenced by a pure auth bypass, so A:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
code-projects Computer Laboratory System 1.0 has a SQL injection vulnerability, where entering a universal password in the Password field on the login page can bypass login attempts.
Executive ViewAI
CVE-2025-60307 is a critical authentication bypass in code-projects Computer Laboratory System 1.0 that allows unauthenticated remote attackers to gain unrestricted system access via SQL injection, with no vendor patch currently available. Any organization running this system faces immediate risk of unauthorized account access, data breach, and operational compromise. The public availability of working exploit code creates urgent remediation pressure despite current low exploitation rates.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network segmentation restricting access to affected systems to internal networks only; (2) Web Application Firewall rules blocking common SQL injection patterns (e.g., single quotes, boolean logic: ' OR '1'='1); (3) strict input validation and parameterized queries (if source code access available); (4) rate-limiting on login endpoint to slow brute-force and injection attempts; (5) mandatory multi-factor authentication if supported by the system; (6) continuous monitoring and alerting on failed login attempts and SQL errors in application logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
More in Computer Laboratory System
View allcode-projects Computer Laboratory System 1.0 has a file upload vulnerability. Rated high severity (CVSS 7.3), this vulne
Unrestricted file upload in Computer Laboratory System 1.0 via the technical_staff_pic.php file allows high-privilege us
Unrestricted file upload in Computer Laboratory System 1.0 via the admin_pic.php image parameter allows high-privilege a
Exploit-DB