What is the CVSS score of CVE-2025-67405?

CVE-2025-67405 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of CASAP Enrollment System are affected by CVE-2025-67405?

SQL injection vulnerability in Sourcecodester CASAP Automated Enrollment System 1.0 exposes organizations to potential data breaches and account compromise through the password update function.

How to fix or mitigate CVE-2025-67405?

Within 24 hours, determine whether your organization uses CASAP Automated Enrollment System 1.0 and, if so, immediately implement network access restrictions or take the system offline if operationally feasible. Review audit logs for suspicious password update activity. Within 7 days, deploy Web Application Firewall (WAF) rules configured to detect and block SQL injection patterns in the new_password parameter, and contact Sourcecodester to confirm patch status and timeline. Within 30 days, either migrate to a patched version of CASAP if available, evaluate migration to an alternative enrollment system, or implement comprehensive input validation and parameterized query enforcement across all database interactions.

CASAP Enrollment System CVE-2025-67405

EUVD-2025-210535 HIGH

SQL Injection (CWE-89)

2026-07-29 mitre

GHSA-4p7v-v4v3-f9cp

PHP SQLi N A

7.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

9.1 CRITICAL

Network-reachable SQLi with no confirmed auth (PR:N per input) typically yields full DB read/write, so C:H/I:H; no availability impact evidenced, so A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:53 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

7.3 (HIGH)

CVE Published

Jul 29, 2026 - 00:00 cve.org

HIGH 7.3

CVE Published

Jul 29, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_password.php via the parameter new_password.

AnalysisAI

SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets attackers manipulate the backend database through the new_password parameter of update_password.php, enabling data theft, credential tampering, and unauthorized account takeover. The flaw is a classic CWE-89 injection in a small PHP web application, with publicly available exploit code (TaintRadar/VulDB) but no public exploit confirmed as actively used. EPSS is low (0.14%, 4th percentile), consistent with a niche product that is documented but not mass-targeted.

Technical ContextAI

CASAP Automated Enrollment System is a lightweight open-source PHP/MySQL web application distributed by Sourcecodester for managing student enrollment. The vulnerability is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the update_password.php endpoint concatenates the user-supplied new_password value directly into a SQL statement (typically an UPDATE against the user/account table) without parameterization or input sanitization. Because the value is interpolated into a query, an attacker can break out of the intended string context and inject arbitrary SQL clauses. The CPE data provided is a placeholder (cpe:2.3:a:n/a:n/a:*), so the affected component is identified only from the description rather than a normalized NVD product entry.

RemediationAI

No vendor-released patch identified at time of analysis, as Sourcecodester code samples are rarely formally versioned or maintained. The primary fix is to rewrite the update_password.php query to use parameterized/prepared statements (PDO or mysqli bound parameters) instead of concatenating new_password into SQL, plus server-side input validation. As compensating controls until code is fixed: place the application behind a WAF with SQL-injection signatures targeting the new_password parameter (trade-off: signatures can be evaded and may reject legitimate special characters in passwords); restrict network access to the enrollment application to trusted internal networks or VPN (trade-off: hurts remote self-service usability); enforce least-privilege on the MySQL account so it cannot read/write beyond required tables (trade-off: limited protection if injected queries stay within those tables); and disable or remove update_password.php if the function is not needed. Consult the VulDB advisory (https://vuldb.com/vuln/384302) and TaintRadar writeup to validate any mitigation.