EUVD-2025-209444
GHSA-v2jv-4wf4-cwj4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated low-complexity network SQLi; description limits impact to reading data, so C:H but I:N/A:N since no write or DoS is claimed.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A SQL injection vulnerability exists in the School Management System (version 1.0) by manikandan580. An unauthenticated or authenticated remote attacker can supply a crafted HTTP request to the affected endpoint to manipulate SQL query logic and extract sensitive database information.
AnalysisAI
SQL injection in manikandan580's School Management System version 1.0 lets a remote attacker inject malicious SQL through a crafted HTTP request to a vulnerable endpoint, manipulating query logic to read sensitive database contents such as credentials and student/staff records. The advisory and CVSS PR:N indicate the flaw is reachable without authentication, and publicly available exploit code exists (proof-of-concept published), though EPSS remains very low at 0.03% and it is not listed in CISA KEV. SSVC rates technical impact as total and the attack as automatable, making it an attractive target for opportunistic scanning despite its niche footprint.
Technical ContextAI
The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input from an HTTP parameter is concatenated directly into a SQL statement without parameterization or sanitization. The affected software is a small PHP/MySQL-style web application (School Management System 1.0), a single-developer project distributed via source repositories rather than an enterprise product. Because the injection point sits in a query that the application executes against its backend database, an attacker can alter the WHERE/UNION logic to enumerate schema and exfiltrate arbitrary table data. The CPE string provided (cpe:2.3:a:n/a:n/a:*) is a placeholder with no meaningful vendor/product mapping, so exact affected component identification relies on the description and third-party advisory rather than a normalized NVD CPE.
RemediationAI
No vendor-released patch identified at time of analysis - the product is a single-developer project with no advisory pointing to a fixed release, so upgrading to a specific patched version is not currently possible. Immediate compensating controls: place the application behind a WAF with SQL-injection rulesets and restrict access to the affected endpoint to trusted networks or authenticated users via reverse-proxy ACLs (trade-off: may break legitimate public access to school portals). At the code level, the durable fix is to convert the vulnerable query to parameterized/prepared statements and validate input types; deploying least-privilege database accounts (read-only where possible, no DROP/FILE privileges) limits data exposure and blocks schema modification if injection persists. Given the low deployment footprint and absence of an upstream fix, the safest option for most operators is to take the application offline or firewall it until a corrected version is published. Consult the advisory at https://github.com/TREXNEGRO/Security-Advisories/blob/main/CVE-2025-65133/README.md for the exact vulnerable parameter.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today