Student Management System CVE-2025-66947

Exploitation targets the editid GET parameter of /studentms/admin/edit-class-detail.php in Student Management System 1.0; the attacker must be able to reach this administrative endpoint and supply a crafted editid value carrying a time-based (SLEEP()) SQL payload. The primary limiting factor is that this is an administrative module - the '/admin/' path and 'administrative module' wording strongly imply a valid or compromised admin session is required, which contradicts the input vector's PR:N and should be verified with the code/vendor. Exploitation is blind and inference-based, so it is slower and noisier (many timed requests) than an error- or union-based extraction, but requires no user interaction and no special non-default configuration beyond having the application deployed.

Signals are mixed and point to a low-to-moderate real-world priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 6.5) describes a trivially reachable network-based injection, but the description explicitly places the flaw 'within an administrative module' (/studentms/admin/edit-class-detail.php), which strongly implies an authenticated admin session is normally required - this conflicts with the PR:N in the vector and should be verified; if auth is in fact required, effective risk drops further. EPSS is low at 0.28% (19th percentile), indicating little expectation of broad automated exploitation. The CVE is NOT on CISA KEV, so there is no evidence of active exploitation; however publicly available exploit code exists (GitHub POC), which lowers the skill barrier. Impact scoring (C:L/I:L/A:N) understates the described outcome of 'full database compromise' from a blind SQL injection, which typically yields complete read of the database (C:H) - this is a notable disagreement between the stated impact metrics and the described consequence. Net: this is a real but low-priority issue, constrained by the product's obscurity and the likely admin-access prerequisite rather than a widespread emergency.

An attacker with reach to the admin panel sends a request to /studentms/admin/edit-class-detail.php with a crafted editid value containing a time-based payload (SQL SLEEP()), observing response-timing differences to infer database contents character by character. A public proof-of-concept exists on GitHub, so exploitation requires little custom development. Because this is an administrative endpoint, realistic exploitation most likely presumes a valid or compromised admin session despite the network attack vector.