CVE-2025-10409: Student Grading System SQL Injection Flaw

CVE-2025-10409 Overview

CVE-2025-10409 is a SQL injection vulnerability in SourceCodester Student Grading System 1.0, developed by oretnom23. The flaw resides in the /rms.php?page=users endpoint, where the fname parameter is not properly sanitized before being passed into a backend SQL query. An authenticated remote attacker with low privileges can manipulate the parameter to inject arbitrary SQL statements. The exploit details have been published publicly, increasing the likelihood of opportunistic abuse against exposed installations. The vulnerability is tracked under [CWE-89] (SQL Injection) and [CWE-74] (Injection).

Critical Impact
Remote attackers can manipulate the fname parameter in /rms.php?page=users to execute arbitrary SQL queries, exposing or modifying records in the grading system database.

Affected Products

Oretnom23 Student Grading System 1.0
CPE: cpe:2.3:a:oretnom23:student_grading_system:1.0:*:*:*:*:*:*:*
Distributed via the SourceCodester resource repository

Discovery Timeline

2025-09-14 - CVE-2025-10409 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10409

Vulnerability Analysis

The vulnerability is a classic SQL injection issue in the user management workflow of the Student Grading System. When a request is sent to /rms.php?page=users, the application incorporates the fname argument into a SQL statement without parameterized binding or input sanitization. An attacker who supplies SQL metacharacters can alter the structure of the query.

The attack can be launched remotely over the network and requires only low-privilege authentication to the application. Because the exploit has been released publicly, attackers can adapt it with minimal effort. Successful exploitation can lead to disclosure of student records, modification of grades, or injection of malicious data into administrative views.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. The fname request parameter is concatenated directly into a query string instead of being passed through prepared statements or strict allow-list validation. This violates the input-handling guidance described in [CWE-89].

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP request to /rms.php?page=users containing malicious payloads in the fname field. Typical payloads use boolean-based, error-based, or UNION-based techniques to extract database contents. Since the application is a PHP script backed by MySQL, common tools such as automated SQL injection scanners can identify and exploit the flaw reliably.

No verified exploit code is published in the referenced advisories beyond proof-of-concept discussion in the GitHub CVE Issue Discussion and the VulDB entry.

Detection Methods for CVE-2025-10409

Indicators of Compromise

HTTP requests to /rms.php?page=users containing SQL metacharacters such as single quotes, UNION SELECT, OR 1=1, or comment sequences (--, #) in the fname parameter
Unusual database error messages logged by the PHP application or web server
New or modified rows in the users table that do not correlate to legitimate administrative activity
Outbound requests from the web server immediately following anomalous /rms.php traffic, which may indicate post-exploitation activity

Detection Strategies

Deploy web application firewall (WAF) signatures that match SQL injection payloads targeting the fname parameter on /rms.php
Enable verbose query logging on the MySQL backend and alert on syntactically anomalous queries originating from the grading system
Correlate authentication events with subsequent requests to /rms.php?page=users to identify low-privilege accounts attempting injection

Monitoring Recommendations

Monitor web server access logs for repeated requests to /rms.php?page=users with encoded SQL keywords
Track failed and successful logins followed by parameter tampering on user management endpoints
Alert on database query response time spikes that may indicate time-based blind SQL injection

How to Mitigate CVE-2025-10409

Immediate Actions Required

Restrict network access to the Student Grading System so that only trusted users on internal networks can reach /rms.php
Audit the users table and application logs for evidence of tampering since the application was deployed
Rotate credentials for any administrative accounts that may have been exposed via SQL injection
Place the application behind a WAF configured to block SQL injection patterns until a code-level fix is applied

Patch Information

No official vendor patch is referenced in the NVD record at the time of publication. Administrators should monitor the SourceCodester Resource Repository and the VulDB advisory for updates. Until a fix is published, the recommended remediation is to modify the affected PHP source to use parameterized queries via PDO or mysqli prepared statements for the fname parameter and any other user-supplied input in /rms.php?page=users.

Workarounds

Replace inline SQL concatenation in /rms.php with prepared statements using mysqli_stmt_bind_param or PDO bindParam
Apply server-side input validation that restricts the fname field to expected character sets such as letters, spaces, and hyphens
Disable or remove the Student Grading System if it is not actively required, given that this is an educational reference application

bash

# Example WAF rule (ModSecurity) to block SQL metacharacters in the fname parameter
SecRule ARGS:fname "@rx (?i)(union(\s|\+)+select|or\s+1=1|--|;|/\*|\bxp_)" \
    "id:1010409,phase:2,deny,status:403,log,\
     msg:'CVE-2025-10409 SQL injection attempt against rms.php fname parameter'"