What is the CVSS score of CVE-2025-67407?

CVE-2025-67407 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of CASAP Automated Enrollment System are affected by CVE-2025-67407?

Sourcecodester CASAP Automated Enrollment System 1.0 contains a database security flaw that could allow unauthorized modification of student enrollment records; no public exploit identified at time…

How to fix or mitigate CVE-2025-67407?

Within 24 hours, verify whether Sourcecodester CASAP Automated Enrollment System 1.0 is deployed in your environment and assess network exposure. Within 7 days, if the system is in use, implement compensating controls including input validation on all parameters submitted to update_student.php, deploy Web Application Firewall (WAF) rules to block SQL injection patterns, restrict database and administrative access permissions, and increase monitoring of enrollment data modifications. Within 30 days, monitor Sourcecodester advisory channels for security patch availability and develop an upgrade strategy; prioritize migration to an alternative enrollment system or prepare additional layered defenses.

CASAP Automated Enrollment System CVE-2025-67407

EUVD-2025-210533 HIGH

SQL Injection (CWE-89)

2026-07-29 mitre

GHSA-786x-w3wg-jwf8

PHP SQLi N A

7.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

8.1 HIGH

SQLi typically yields full DB read/write (C:H/I:H), but the record-edit endpoint is normally admin-reachable so PR:L rather than PR:N; availability impact not evidenced.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:52 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

7.3 (HIGH)

CVE Published

Jul 29, 2026 - 00:00 cve.org

HIGH 7.3

CVE Published

Jul 29, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_student.php via parameters fname and student_class.

AnalysisAI

SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 allows attackers to manipulate backend database queries through the fname and student_class parameters of update_student.php, enabling extraction or tampering of student enrollment records. The flaw carries CVSS 7.3 (network-reachable, low complexity) but is a niche PHP tutorial-grade application with negligible exploitation probability (EPSS 0.14%, 4th percentile), and no public exploit identified at time of analysis. Not listed in CISA KEV.

Technical ContextAI

The affected component is a PHP web application (CASAP Automated Enrollment System) distributed via Sourcecodester, a repository of small-scale/educational PHP projects. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the fname and student_class request parameters are concatenated directly into a SQL statement in update_student.php without parameterization or sanitization, allowing an attacker to break out of the intended query context. Such apps typically use the mysqli/PDO extension against a MySQL/MariaDB backend; the CPE data is uninformative (cpe:2.3:a:n/a:n/a:*) and does not enumerate a real vendor/product, so the affected surface is identified only from the CVE description.

RemediationAI

No vendor-released patch identified at time of analysis - CASAP is an unmaintained Sourcecodester project with no security advisory or fixed release. The definitive fix is to rewrite the affected queries in update_student.php to use parameterized/prepared statements (mysqli or PDO bound parameters) and to apply server-side input validation on the fname and student_class parameters; organizations running this code should apply this at source since no upstream update is expected. As compensating controls until then: place the application behind authentication and restrict update_student.php to authenticated administrators (trade-off: none if it was already meant to be admin-only, closing an unintended exposure); deploy a WAF rule to block SQL metacharacters on the fname and student_class parameters (trade-off: may false-positive on names with apostrophes); and restrict network access to the enrollment app to trusted internal ranges (trade-off: breaks legitimate remote/off-campus use). Given the product's marginal status, decommissioning or replacing it is the most durable option.