What is the CVSS score of CVE-2025-67403?

CVE-2025-67403 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of CASAP Enrollment System are affected by CVE-2025-67403?

CASAP Automated Enrollment System 1.0 contains a critical SQL injection vulnerability (CVE-2025-67403) in the unauthenticated class enrollment module that allows remote attackers to read, modify, or…

How to fix or mitigate CVE-2025-67403?

Within 24 hours, identify all production instances of CASAP 1.0 and inventory connected student records; immediately implement network-level access restrictions to the update_class.php endpoint using WAF rules, IP whitelisting, or firewall policies to limit exposure until remediation. Within 7 days, deploy input validation and parameterized query fixes if source code modification is possible, enable full database transaction logging to detect exploitation, and contact Sourcecodester for patch availability and timeline. Within 30 days, transition to a patched version of CASAP once available from the vendor, or evaluate and migrate to an alternative enrollment platform with current security posture assessment.

CASAP Enrollment System CVE-2025-67403

EUVD-2025-210537 CRITICAL

SQL Injection (CWE-89)

2026-07-29 mitre

GHSA-4xg3-6338-9rxr

PHP SQLi N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable endpoint (AV:N/PR:N/UI:N) with trivial injection (AC:L); SQLi yields full read, modify, and destructive database impact (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:28 vuln.today

CVSS changed

Jul 30, 2026 - 15:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 29, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jul 29, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.php via the parameter class_name.

AnalysisAI

SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers manipulate backend database queries through the unsanitized class_name parameter of update_class.php. Because the flaw is unauthenticated and network-reachable (CVSS 9.8), an attacker can read, alter, or destroy enrollment records and potentially achieve full database compromise. There is publicly available exploit code exists via a public disclosure write-up, though EPSS remains low at 0.14% (4th percentile), indicating limited observed exploitation activity.

Technical ContextAI

The application is a PHP-based student enrollment web system distributed by Sourcecodester, a repository of small, open-source hobby/educational PHP+MySQL projects. The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) issue: the update_class.php endpoint concatenates the user-supplied class_name value directly into a SQL statement without parameterization or escaping. Because CASAP uses a MySQL/MariaDB backend accessed through raw PHP queries, an injected payload alters the query's logic, allowing UNION-based extraction, boolean/time-based blind inference, or destructive UPDATE/DELETE operations. The CPE data is uninformative (cpe:2.3:a:n/a:n/a:*) so exact affected component identification relies on the description naming version 1.0.

RemediationAI

No vendor-released patch identified at time of analysis, as Sourcecodester hobby projects are rarely formally maintained. The primary fix is to rewrite update_class.php to use parameterized queries / prepared statements (PDO or mysqli with bound parameters) for the class_name parameter and all other user inputs, rather than string concatenation. As immediate compensating controls, restrict access to the enrollment application behind authentication and network ACLs, deploy a WAF rule to block SQL metacharacters in the class_name parameter (trade-off: may false-positive on legitimate class names containing quotes), and apply least-privilege database accounts so the web user cannot DROP/ALTER tables (trade-off: does not stop data exfiltration). Given the product's unmaintained nature, migrating off CASAP to a supported enrollment platform is the most durable option. Refer to the technical write-up at https://github.com/um-dsp/TaintRadar and the VulDB entry https://vuldb.com/vuln/384300 for details.