CVE-2025-10408: Student Grading System SQL Injection Flaw

CVE-2025-10408 Overview

CVE-2025-10408 is a SQL injection vulnerability in SourceCodester Student Grading System 1.0, developed by oretnom23. The flaw resides in the /edit_user.php script, where the ID parameter is not sanitized before being used in a database query. Remote attackers with low-privileged access can manipulate this parameter to inject arbitrary SQL statements. The exploit has been disclosed publicly, increasing the likelihood of opportunistic attacks against exposed instances. The issue is tracked under [CWE-89] (SQL Injection) and [CWE-74] (Improper Neutralization of Special Elements).

Critical Impact
Authenticated remote attackers can manipulate the ID parameter in /edit_user.php to execute arbitrary SQL, leading to unauthorized read, modification, or limited disruption of the grading system database.

Affected Products

SourceCodester Student Grading System 1.0
oretnom23 student_grading_system (CPE: cpe:2.3:a:oretnom23:student_grading_system:1.0)
All deployments exposing /edit_user.php to untrusted users

Discovery Timeline

2025-09-14 - CVE-2025-10408 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10408

Vulnerability Analysis

The vulnerability exists in the edit_user.php endpoint of the Student Grading System 1.0 application. The ID request parameter flows into a SQL query without parameterization or input validation. An attacker can append SQL operators, UNION clauses, or boolean conditions to alter query logic. Because the application is a PHP web application backed by a relational database, the injected SQL executes with the privileges of the database user configured for the application.

Public exploitation details have been published, including references on GitHub and VulDB #323842. Attackers can leverage the flaw to enumerate database contents, extract user credentials, or modify grading records. The attack requires authenticated access at a low privilege level but no user interaction.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The application concatenates the user-supplied ID parameter directly into a SQL statement instead of using prepared statements or parameterized queries. PHP's mysqli and PDO libraries support prepared statements, but the affected code path does not apply them.

Attack Vector

The attack vector is remote over the network. An authenticated attacker submits a crafted request to /edit_user.php with a malicious value supplied via the ID parameter. Typical payloads include boolean-based blind injection (' OR 1=1--), UNION-based extraction (' UNION SELECT user, password FROM users--), and time-based blind injection using SLEEP() functions. No additional preconditions are required beyond access to the application.

No verified proof-of-concept code is reproduced here. See the GitHub CVE Issue Discussion for publicly disclosed technical details.

Detection Methods for CVE-2025-10408

Indicators of Compromise

HTTP requests to /edit_user.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP(, or comment sequences (--, #) in the ID parameter
Web server access logs showing repeated requests to /edit_user.php with abnormally long or encoded ID values
Database error messages or unexpected query latency correlating with requests to the grading system

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the ID parameter on /edit_user.php and block known SQL injection signatures
Enable database query logging and alert on queries originating from the grading system that contain UNION, INFORMATION_SCHEMA, or stacked statements
Review authentication and session logs for low-privileged accounts performing administrative actions through edit_user.php

Monitoring Recommendations

Forward web server, PHP error, and database logs to a centralized logging platform for correlation
Alert on HTTP 500 responses from /edit_user.php, which often indicate failed injection attempts
Track changes to the users and grading tables and alert on modifications outside expected administrative workflows

How to Mitigate CVE-2025-10408

Immediate Actions Required

Restrict access to /edit_user.php to trusted administrative networks using firewall or reverse proxy rules
Audit the users table and grading records for unauthorized modifications since application deployment
Rotate database and application credentials if exposure is suspected

Patch Information

No official vendor patch is referenced in the CVE record at the time of publication. SourceCodester projects are frequently distributed as source code without ongoing maintenance. Administrators should review the application source, replace string-concatenated SQL queries in edit_user.php with prepared statements using mysqli_prepare() or PDO parameter binding, and validate that the ID parameter is a strict integer.

Workarounds

Remove or disable the Student Grading System 1.0 from production if a maintained alternative is available
Place the application behind a WAF configured with OWASP Core Rule Set SQL injection signatures
Apply server-side input validation to enforce that the ID parameter accepts only numeric values
Restrict the database account used by the application to least-privilege permissions, denying access to system tables

bash

# Example nginx configuration to enforce numeric ID parameter
location = /edit_user.php {
    if ($arg_id !~ ^[0-9]+$) {
        return 400;
    }
    fastcgi_pass php_backend;
}