What is the CVSS score of EUVD-2025-210532?

EUVD-2025-210532 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of CASAP Enrollment System are affected by EUVD-2025-210532?

A SQL injection vulnerability in Sourcecodester CASAP Automated Enrollment System 1.0 allows remote attackers to manipulate database queries through unsanitized input parameters, enabling…

How to fix or mitigate EUVD-2025-210532?

Within 24 hours, identify all instances of CASAP Automated Enrollment System 1.0 in production and staging environments, and assess data sensitivity and exposure scope. Within 7 days, implement interim controls including strict input validation with prepared statements for database queries on the /save_user.php endpoint, deploy Web Application Firewall rules to block SQL injection patterns, restrict network access to authorized users and systems only, and enable comprehensive query logging. Within 30 days, migrate to a supported enrollment system or decommission CASAP 1.0 entirely, as no vendor patch exists for this end-of-life product.

CASAP Enrollment System EUVD-2025-210532

| CVE-2025-67408 HIGH

SQL Injection (CWE-89)

2026-07-29 mitre

GHSA-fjfr-wjrh-qmv2

PHP SQLi N A

7.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Network-reachable SQLi with low complexity and no confirmed auth (PR:N, though the admin endpoint may require login), giving partial C/I/A impact on the app database.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:38 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

7.3 (HIGH)

CVE Published

Jul 29, 2026 - 00:00 cve.org

HIGH 7.3

CVE Published

Jul 29, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user.php via the parameter status.

AnalysisAI

SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers manipulate backend database queries through the unsanitized 'status' parameter of /save_user.php, enabling data theft, tampering, or authentication bypass. The flaw carries a CVSS 7.3 and a documented technical writeup exists in the TaintRadar research repository, though it is not listed in CISA KEV and its EPSS exploitation probability is very low (0.14%, 4th percentile). No vendor patch has been identified for this end-of-life hobbyist PHP application.

Technical ContextAI

The affected component is CASAP Automated Enrollment System 1.0, a small PHP/MySQL web application distributed by Sourcecodester and typically used for demonstration or small-scale school enrollment projects. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the 'status' parameter received by /save_user.php is concatenated directly into a SQL statement without parameterization or input validation, allowing attacker-controlled input to alter query logic. Because these Sourcecodester applications generally use raw mysqli/mysql_query string building rather than prepared statements, the injection point in the user-save routine can be used to read from or write to arbitrary tables reachable by the application's database user. CPE data is uninformative here (cpe:2.3:a:n/a:n/a:*), so the affected product is confirmed only from the MITRE description text.

RemediationAI

No vendor-released patch identified at time of analysis, as CASAP Automated Enrollment System is an unmaintained Sourcecodester demo project. The definitive fix is to rewrite /save_user.php to use parameterized queries/prepared statements (mysqli or PDO with bound parameters) for the 'status' value and all other user-supplied inputs; if you cannot modify source, apply strict server-side allowlist validation on 'status' (it should accept only a fixed enumerated set such as active/inactive numeric codes). As compensating controls, place the application behind a WAF with SQL-injection rules covering the status parameter (trade-off: rule bypasses are common and this is not a substitute for input handling), restrict access to /save_user.php to authenticated administrators via server-level auth or IP allowlisting (trade-off: only helps if the endpoint is not meant to be public), and run the database account with least privilege so injection cannot reach other schemas. Given the software's status, migrating off this application is the most durable option. Consult the technical writeup (TaintRadar GitHub link above) and the NVD entry for details.