What is the CVSS score of CVE-2025-65135?

CVE-2025-65135 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2025-65135?

CVE-2025-65135 is a critical unauthenticated SQL injection vulnerability in manikandan580 School Management System 1.0 that allows remote attackers to extract or modify database contents without…

How to fix or mitigate CVE-2025-65135?

Within 24 hours: Identify all instances of manikandan580 School Management System 1.0 in your environment and isolate affected systems from production networks if possible. Within 7 days: Implement network-level access controls restricting access to /studentms/admin/between-date-reprtsdetails.php to authorized personnel only, and apply Web Application Firewall (WAF) rules to block POST requests containing SQL injection patterns in the fromdate parameter. Within 30 days: Evaluate migration to a patched or alternative School Management System; contact the vendor for updates or security guidance, and conduct database audit for unauthorized access or modification.

PHP CVE-2025-65135

EUVD-2025-209446 CRITICAL

SQL Injection (CWE-89)

2026-04-14 mitre

GHSA-27pw-mrx7-45mq

PHP SQLi

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:37 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 17:00 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 16:00 euvd

EUVD-2025-209446

Analysis Generated

Apr 14, 2026 - 16:00 vuln.today

CVE Published

Apr 14, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin/between-date-reprtsdetails.php through the fromdate POST parameter.

AnalysisAI

Time-based blind SQL injection in manikandan580 School Management System 1.0 allows unauthenticated remote attackers to extract sensitive database contents and potentially execute arbitrary SQL commands through the fromdate POST parameter in /studentms/admin/between-date-reprtsdetails.php. The CVSS 9.8 critical score reflects network-based exploitation requiring no privileges or user interaction, with complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though the specific vulnerable parameter and injection type are documented in public security advisories.

Technical ContextAI

This vulnerability affects a PHP-based school management system developed by manikandan580. Time-based blind SQL injection is a technique where attackers inject SQL commands that cause deliberate delays in database responses, allowing them to infer data through timing analysis even when error messages or direct output are not visible. The vulnerable endpoint /studentms/admin/between-date-reprtsdetails.php appears to be an administrative report generation function that accepts date range parameters. The fromdate POST parameter lacks proper input sanitization and parameterized query implementation, allowing attackers to append malicious SQL commands (such as WAITFOR DELAY or SLEEP functions) that the backend database executes. This vulnerability class enables complete database compromise through automated extraction techniques, even without direct query result visibility.

RemediationAI

Organizations must immediately implement input validation and parameterized SQL queries for the fromdate POST parameter in /studentms/admin/between-date-reprtsdetails.php using prepared statements with bound parameters appropriate to the backend database system (MySQLi or PDO for typical PHP deployments). No vendor-released patch identified at time of analysis; administrators should apply code-level fixes manually by replacing string concatenation with prepared statements in the vulnerable file. As interim mitigation, restrict network access to /studentms/admin/ paths using web application firewall rules or authentication gateway controls to limit exposure to trusted administrative networks only. Implement database account privilege separation ensuring the application database user cannot execute administrative commands beyond necessary CRUD operations. Review all date input handling throughout the application for similar SQL injection vulnerabilities, as this appears symptomatic of systemic input validation failures. Security advisory details available at https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2025-65135 provide technical documentation for remediation efforts.