What is the CVSS score of CVE-2025-67404?

CVE-2025-67404 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of CASAP Automated Enrollment System are affected by CVE-2025-67404?

CASAP Automated Enrollment System 1.0 is vulnerable to unauthorized database access through its enrollment forms, enabling attackers to read, modify, or compromise student enrollment records and…

How to fix or mitigate CVE-2025-67404?

Within 24 hours, identify all deployed instances of CASAP 1.0, classify systems handling active enrollment data as critical, and prepare an offline contingency plan. Within 7 days, deploy Web Application Firewall rules to block attacks targeting the enrollment form parameters (fname, lname, student_class) in save_stud.php, implement strict input validation, and restrict database account privileges to minimum necessary permissions. Within 30 days, contact Sourcecodester for patch availability; if available, test and deploy immediately; if not, evaluate alternative enrollment systems or maintain compensating controls indefinitely.

CASAP Automated Enrollment System CVE-2025-67404

EUVD-2025-210536 CRITICAL

SQL Injection (CWE-89)

2026-07-29 mitre

GHSA-vv6v-98gx-r829

PHP SQLi N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable SQLi sink with no confirmed auth gate gives AV:N/AC:L/PR:N/UI:N; direct database access yields full C:H/I:H/A:H, though PR could rise to L if the endpoint is login-gated.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:28 vuln.today

CVSS changed

Jul 30, 2026 - 15:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 29, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jul 29, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php via the parameters fname, lname, and student_class.

AnalysisAI

SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers inject arbitrary SQL through the fname, lname, and student_class parameters of save_stud.php, enabling database read, modification, and potential full compromise of enrollment records. The flaw carries a 9.8 CVSS rating reflecting network-reachable, low-complexity exploitation with high confidentiality, integrity, and availability impact. It is not in CISA KEV and its EPSS score is low (0.14%, 4th percentile); no public exploit identified at time of analysis, though an automated TaintRadar taint-analysis writeup documents the injection path.

Technical ContextAI

CASAP is a small PHP/MySQL web application distributed by Sourcecodester for automating school student enrollment. The vulnerable component, save_stud.php, persists new student records but incorporates the fname, lname, and student_class request parameters directly into a SQL statement without parameterization or input sanitization. This is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) defect: user-controlled strings are concatenated into the query, so metacharacters such as quotes and UNION clauses alter query structure. The provided CPE string (cpe:2.3:a:n/a:n/a) is a placeholder with no meaningful vendor/product/version data, so exact affected-product identification relies on the CVE description rather than structured CPE.

RemediationAI

No vendor-released patch identified at time of analysis; Sourcecodester projects frequently receive no formal fix, so plan to remediate at the code or deployment layer. The primary fix is to rewrite save_stud.php to use parameterized queries / prepared statements (e.g., PDO or mysqli bound parameters) for fname, lname, and student_class rather than string concatenation, and to apply server-side input validation. As compensating controls where source cannot be modified immediately: place the application behind a WAF with SQLi signatures tuned for these three parameters (trade-off: signature bypasses are possible), restrict network access to save_stud.php to trusted internal networks or authenticated sessions (trade-off: may break legitimate self-service enrollment if that is a public feature), and enforce least-privilege on the MySQL account so the web user cannot read other databases or write files (trade-off: none significant, recommended regardless). Consult the NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-67404) and VulDB (https://vuldb.com/vuln/384301) entries for updates.