CVE-2025-10407: Student Grading System SQLi Vulnerability

CVE-2025-10407 Overview

CVE-2025-10407 is a SQL injection vulnerability in SourceCodester Student Grading System 1.0, developed by oretnom23. The flaw exists in the /view_user.php script, where the ID parameter is incorporated into a database query without proper sanitization. An authenticated remote attacker can manipulate this parameter to inject arbitrary SQL statements. Public disclosure indicates the exploit details are available, increasing the likelihood of opportunistic abuse against exposed deployments. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Improper Neutralization in Output).

Critical Impact
Remote authenticated attackers can inject SQL through the ID parameter in /view_user.php, potentially exposing or modifying grading system data.

Affected Products

SourceCodester Student Grading System 1.0
oretnom23 student_grading_system (CPE: cpe:2.3:a:oretnom23:student_grading_system:1.0)
Deployments using the vulnerable /view_user.php endpoint

Discovery Timeline

2025-09-14 - CVE-2025-10407 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10407

Vulnerability Analysis

The vulnerability resides in /view_user.php within the Student Grading System 1.0 codebase. The script accepts an ID parameter through an HTTP request and concatenates it into an SQL query without parameterization or input validation. Attackers can supply crafted input that alters query semantics, enabling extraction of database records, authentication data, or grade information. The attack requires low privileges and no user interaction, and it can be launched remotely against any reachable instance. According to public references, working exploit details have been disclosed through VulDB entry 323841 and a corresponding GitHub issue.

Root Cause

The root cause is improper neutralization of user-supplied input before it reaches the SQL interpreter. The application builds queries through string concatenation rather than using prepared statements or parameter binding, which allows special characters such as single quotes and SQL keywords to break out of the intended query context.

Attack Vector

An attacker sends an HTTP request to /view_user.php with a malicious value in the ID parameter. Because authentication context is required (PR:L), the attacker must hold valid low-privilege credentials or chain the issue with another flaw. Once injected, the payload executes against the backend database with the privileges of the web application's database user.

No verified proof-of-concept code is reproduced here. Technical exploitation details are documented in the VulDB submission 646909 and the linked GitHub issue.

Detection Methods for CVE-2025-10407

Indicators of Compromise

HTTP requests to /view_user.php containing SQL metacharacters such as ', ", --, UNION, SELECT, or OR 1=1 in the ID parameter
Unusual database error messages in application logs referencing syntax errors near user-supplied input
Unexpected outbound data transfers from the application server immediately following access to view_user.php

Detection Strategies

Inspect web server access logs for view_user.php requests with abnormal ID parameter lengths or encoded SQL tokens
Deploy web application firewall rules that flag SQL injection signatures targeting the ID query string parameter
Correlate authenticated session activity with database query anomalies, such as queries returning unusually large result sets

Monitoring Recommendations

Enable database query logging on the backend MySQL or MariaDB instance and alert on SELECT statements with UNION clauses originating from the grading application user
Forward web and database telemetry to a centralized log platform for correlation across authentication, request, and query events
Track failed login attempts followed by successful access to view_user.php, which may indicate credential testing prior to exploitation

How to Mitigate CVE-2025-10407

Immediate Actions Required

Restrict access to the Student Grading System to trusted networks until a fix is applied
Audit application accounts and rotate credentials for any user with access to /view_user.php
Review recent database query logs for evidence of injection attempts against the ID parameter

Patch Information

No vendor patch has been published in the referenced advisories at the time of writing. Administrators should monitor the SourceCodester project page and the VulDB CTI entry for updates. In the absence of an official fix, modify the application source to use prepared statements with parameter binding in view_user.php.

Workarounds

Replace inline SQL in view_user.php with parameterized queries using PDO or MySQLi prepared statements
Add server-side input validation to enforce that ID is a numeric value before it reaches any query builder
Deploy a web application firewall with SQL injection rulesets in front of the application until source-level remediation is complete
Apply least-privilege principles to the database account used by the web application, limiting it to required tables and operations

bash

# Example nginx configuration to block non-numeric ID values
location = /view_user.php {
    if ($arg_id !~ "^[0-9]+$") {
        return 403;
    }
    fastcgi_pass php-fpm;
}