EUVD-2025-201732Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to /newrecord.php
-
ExploitInject SQL payload in ID parameter
-
ExecutionExecute arbitrary SQL queries
-
ImpactExtract or alter database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Student Management System 1.0. The vulnerable script /newrecord.php is publicly accessible and does not require authentication or user interaction. |
| Impact | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) rates the vulnerability Medium (5.5) with low impact on the vulnerable system. However, SQL injection typically enables complete database compromise; a realistic independent assessment suggests high confidentiality and integrity impact. The EPSS score of 0.04% (11th percentile) indicates a very low probability of widespread exploitation, and the absence of KEV listing means there is no evidence of active attacks. Public exploit availability (E:P) increases the risk slightly, but overall this is a lower-priority issue unless the application stores sensitive data. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to /newrecord.php with a malicious ID parameter (e.g., ' OR '1'='1'), causing the backend database to execute arbitrary SQL statements. This can dump sensitive student records or modify grades. Public proof-of-concept code is available in a GitHub issue. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 26, 2026
SQL injection in Student Management System 1.0 allows remote attackers to manipulate the ID parameter in /newrecord.php, potentially reading or modifying database contents. Exploit code is publicly available, though the EPSS exploitation probability is low (0.04%). No active exploitation has been reported by CISA KEV.
RemediationAI
No vendor-released patch has been identified at the time of analysis. As a workaround, apply input validation or parameterized queries to the ID parameter in /newrecord.php. If immediate code changes are not feasible, restrict network access to the script or deploy a web application firewall (WAF) rule blocking SQL injection patterns for that parameter. Disabling the /newrecord.php functionality altogether may be considered if it is not essential, though that could break application functionality. A vendor patch remains the recommended long-term solution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in a PHP-based web application (Student Management System 1.0). The /newrecord.php script constructs SQL queries using unsanitized user input from the ID parameter, leading to SQL injection (CWE-74). The affected product is identified by the CPE cpe:2.3:a:angeljudesuarez:student_management_system:1.0:*:*:*:*:*:*:*.
Know when Student Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
SQL injection allows full database access; remote, no privileges or user interaction; availability not impacted.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
5DescriptionCVE.org
A flaw has been found in itsourcecode Student Management System 1.0. Affected is an unknown function of the file /newrecord.php. Executing manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.
Executive ViewAI
Organizations using A flaw face moderate risk from CVE-2025-14257, a injection vulnerability rated CVSS 7.3. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. Proof-of-concept code is publicly available, increasing the risk of exploitation. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Student Management System
View allA vulnerability, which was classified as critical, was found in SourceCodester Student Management System. Rated critical
Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: (
phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata
A vulnerability classified as critical has been found in itsourcecode Student Management System 1.0. Rated medium severi
A vulnerability classified as critical has been found in SourceCodester Student Management System 1.0. Rated medium seve
Time-based blind SQL injection in krishanmurariji Student Management System 1.0 lets an attacker who can reach the /stud
A vulnerability classified as critical has been found in ningzichun Student Management System 1.0. Rated critical severi
A vulnerability was found in ningzichun Student Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerab
Authorization bypass in ningzichun's student-management-system (all versions up to commit 98760f5711cf6dc8b4adca53a9e207
Authorization bypass in ningzichun student-management-system (versions up to commit 98760f5711cf6dc8b4adca53a9e207ca49b0
Authentication bypass in ealpha072's Student-Management-System PHP application exposes the administrative backend to rem
Authentication bypass in sayan365's Student Management System exposes multiple protected endpoints to remote unauthentic
Exploit-DB