CVE-2025-10418: Student Grading System SQLi Vulnerability

CVE-2025-10418 Overview

CVE-2025-10418 is a SQL injection vulnerability in SourceCodester Student Grading System 1.0. The flaw resides in the /view_students.php file, where the ID parameter is passed directly into a SQL query without proper sanitization. Attackers can manipulate this argument to inject arbitrary SQL statements. The vulnerability is remotely exploitable and requires low-level privileges. Public disclosure has occurred through VulDB and a GitHub issue, increasing the risk of opportunistic exploitation against exposed deployments. The Common Weakness Enumeration (CWE) classification is [CWE-74], improper neutralization of special elements in output used by a downstream component.

Critical Impact
Authenticated remote attackers can extract, modify, or delete records from the application database by manipulating the ID parameter on /view_students.php.

Affected Products

SourceCodester Student Grading System 1.0
oretnom23 student_grading_system 1.0
PHP/MySQL deployments hosting the view_students.php script

Discovery Timeline

2025-09-15 - CVE-2025-10418 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10418

Vulnerability Analysis

The vulnerability exists in the request-handling logic of /view_students.php. The script accepts the ID HTTP parameter and concatenates it directly into a SQL query string used to retrieve student records. Because the input is not validated, escaped, or bound through a parameterized statement, attackers can break out of the intended query context and append arbitrary SQL clauses.

Exploitation is performed remotely over the network and requires only low privileges within the application. Successful attacks affect the confidentiality, integrity, and availability of data stored in the backing MySQL database. Typical payloads include UNION SELECT queries to enumerate tables, boolean-based blind probes to extract data character by character, and time-based payloads using SLEEP() when no output reflects in the response.

Root Cause

The root cause is unsafe construction of SQL queries through string concatenation of untrusted input. The application does not use prepared statements with bound parameters, nor does it apply allowlist validation to the numeric ID argument before passing it to the database layer.

Attack Vector

The attack vector is network-based HTTP. An authenticated user with access to the student view interface submits a crafted value for the ID parameter, for example via a URL such as view_students.php?ID=1' OR '1'='1. The injected SQL is evaluated by the database engine, returning unintended data or executing administrative operations depending on the database user's privileges.

No verified exploit code is published in the referenced advisories, but the parameter location and payload pattern are documented in the GitHub CVE Issue Discussion and VulDB #323852.

Detection Methods for CVE-2025-10418

Indicators of Compromise

HTTP requests to /view_students.php where the ID parameter contains SQL metacharacters such as ', ", --, ;, UNION, SELECT, or SLEEP(.
Web server access logs showing repeated requests to view_students.php with incrementing or encoded payloads from a single source address.
Database error messages referencing syntax errors near unexpected tokens when processing view_students.php queries.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set that flags SQL injection patterns targeting the ID parameter of view_students.php.
Enable MySQL general query log or audit plugin to capture queries containing tautologies, UNION operators, or unexpected INFORMATION_SCHEMA references originating from the application user.
Correlate HTTP 500 responses from view_students.php with subsequent successful 200 responses carrying large payloads, which often indicates payload tuning followed by data exfiltration.

Monitoring Recommendations

Monitor authentication logs for low-privileged accounts that suddenly access view_students.php at elevated rates.
Track outbound network traffic from the database host for unexpected egress that could indicate exfiltration after compromise.
Alert on schema enumeration patterns referencing information_schema.tables or information_schema.columns from the web application's database user.

How to Mitigate CVE-2025-10418

Immediate Actions Required

Restrict network access to the Student Grading System application to trusted networks until a patch is applied.
Rotate database credentials used by the application and confirm that the database user holds only the minimum privileges required for normal operation.
Review web and database logs for the indicators described above to determine whether exploitation has already occurred.

Patch Information

No official vendor patch is published in the referenced advisories at the time of writing. Refer to the SourceCodester Security Resources and the VulDB CTI ID #323852 entry for updates. Administrators should replace concatenated SQL with prepared statements using PDO or mysqli parameter binding in view_students.php.

Workarounds

Apply server-side input validation that rejects any ID value that is not a positive integer before the value reaches the database query.
Place the application behind a WAF with an active rule set such as the OWASP ModSecurity Core Rule Set to block common SQL injection signatures.
Configure the MySQL account used by the application with SELECT-only privileges where feasible, removing UPDATE, DELETE, and FILE privileges to limit blast radius.

bash

# Example: enforce numeric validation in PHP using prepared statements
# Replace direct concatenation in view_students.php with parameterized queries
#
#   $id = filter_input(INPUT_GET, 'ID', FILTER_VALIDATE_INT);
#   if ($id === false || $id === null) { http_response_code(400); exit; }
#   $stmt = $pdo->prepare('SELECT * FROM students WHERE id = :id');
#   $stmt->execute([':id' => $id]);