Student Result Management System CVE-2025-7534

Multiple risk signals converge to indicate HIGH real-world priority despite moderate CVSS 7.3: (1) Attack Vector: Network + Authentication: None + User Interaction: None = maximum exploitability; (2) Attack Complexity: Low = trivial to execute; (3) Public POC disclosure = active threat landscape maturation; (4) Unauthenticated attack surface on a web-accessible parameter = low friction for mass exploitation; (5) SQL injection impact on a Student Result Management System = potential for grade tampering, data exfiltration, and system compromise affecting institutional trust. CVSS 7.3 reflects moderate impact scope (Confidentiality, Integrity, Availability all Low within Single context), but the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U vector indicates this is maximally exploitable. Without EPSS or KEV data explicitly provided, industry patterns suggest SQL injection on publicly disclosed vulnerabilities with working POC typically reaches 80%+ exploitation probability within 30 days. This is a priority-patch vulnerability.

An attacker identifies the PHPGurukul Student Result Management System 2.0 endpoint /notice-details.php?nid=1 via public internet scan or targeted reconnaissance. The attacker tests the 'nid' parameter with SQL injection payloads such as: /notice-details.php?nid=1' OR '1'='1 or /notice-details.php?nid=1 UNION SELECT NULL,username,password FROM users--. The application executes the injected SQL without sanitization, returning database records or error messages that leak schema information. The attacker escalates to data exfiltration (student records, credentials, grades), privilege escalation (if database user has administrative rights), or data destruction. Since AV=N, AC=L, PR=N, UI=N, this requires no social engineering, no local access, and minimal attacker skill with standard SQL injection tools (sqlmap, Burp Suite). Public POC availability accelerates mass exploitation by script kiddies. An institution running this system could experience unauthorized modification of student grades, bulk data theft, or service disruption within hours of public awareness.