CVE-2025-10419 Overview
CVE-2025-10419 is a SQL injection vulnerability affecting SourceCodester Student Grading System 1.0, developed by oretnom23. The flaw resides in the /del_promote.php script, where the sy parameter is passed to a database query without proper sanitization. Remote attackers with low privileges can manipulate the parameter to inject arbitrary SQL statements. The exploit has been disclosed publicly, increasing the likelihood of opportunistic exploitation against exposed instances. The vulnerability is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).
Critical Impact
Authenticated remote attackers can inject SQL via the sy parameter in /del_promote.php, potentially compromising the confidentiality and integrity of student grading data.
Affected Products
- SourceCodester Student Grading System 1.0
- oretnom23 student_grading_system (CPE: cpe:2.3:a:oretnom23:student_grading_system:1.0)
- Deployments exposing /del_promote.php to untrusted networks
Discovery Timeline
- 2025-09-15 - CVE-2025-10419 published to NVD
- 2026-04-29 - Last updated in NVD database
Technical Details for CVE-2025-10419
Vulnerability Analysis
The vulnerability exists in the /del_promote.php endpoint of the Student Grading System web application. The sy request argument, which represents a school year identifier, is concatenated directly into a SQL statement executed against the backend database. Because the application does not use parameterized queries or apply input validation, attackers can break out of the intended query context and append arbitrary SQL clauses. The flaw is reachable over the network and requires only low-level authenticated access to the application. Public disclosure of the exploit details, including a write-up referenced in GitHub Issue for CVE-7 and VulDB #323853, raises the operational risk for exposed deployments.
Root Cause
The root cause is the construction of SQL queries through string concatenation using the unsanitized sy parameter. No prepared statement, type casting, or allowlist validation is applied before the value reaches the database driver. This pattern is a classic instance of improper neutralization of special elements, mapped to [CWE-74].
Attack Vector
An authenticated attacker sends an HTTP request to /del_promote.php with a crafted sy value containing SQL metacharacters. The injected payload can be used to enumerate database structure, extract grade and student records, modify data, or, depending on database privileges, delete records used for academic promotion decisions. The attack is fully remote and does not require user interaction.
No verified proof-of-concept code is provided for inclusion. Refer to the GitHub Issue for CVE-7 for technical details on the injection payload.
Detection Methods for CVE-2025-10419
Indicators of Compromise
- HTTP requests to /del_promote.php containing SQL metacharacters in the sy parameter such as single quotes, UNION, SELECT, --, or OR 1=1.
- Unexpected DELETE, UPDATE, or UNION SELECT statements in MySQL/MariaDB query logs originating from the grading application user.
- Anomalous database error messages returned in HTTP responses from the grading system.
Detection Strategies
- Inspect web server access logs for del_promote.php requests with encoded SQL syntax (%27, %20OR%20, %23, %2D%2D) in the sy query string.
- Enable database query logging and alert on grading application queries that reference tables outside the expected schema or use INFORMATION_SCHEMA.
- Deploy a web application firewall (WAF) rule that flags sy parameter values failing a numeric or short string allowlist.
Monitoring Recommendations
- Correlate authentication events with subsequent suspicious del_promote.php traffic to identify low-privileged accounts being abused.
- Monitor for sudden spikes in 500-series HTTP responses from the grading application, which often indicate injection probing.
- Track outbound database connections and large result-set responses from the PHP application host.
How to Mitigate CVE-2025-10419
Immediate Actions Required
- Restrict network exposure of the Student Grading System to trusted internal networks until a fix is applied.
- Audit accounts on the application and remove or rotate credentials for unused low-privileged users.
- Review /del_promote.php source code and replace string-concatenated SQL with parameterized queries using PDO or mysqli prepared statements.
Patch Information
No official vendor patch is currently referenced in the NVD entry or in the SourceCodester Security Articles portal. Administrators must apply source-level fixes or compensating controls. Track the VulDB CTI ID #323853 entry for future remediation updates.
Workarounds
- Add server-side input validation that constrains sy to a strict numeric or YYYY-YYYY format before query execution.
- Deploy a WAF or reverse proxy rule that blocks SQL metacharacters in the sy parameter for the /del_promote.php endpoint.
- Restrict the database account used by the application to the minimum privileges required, removing DELETE and DDL permissions where possible.
# Example ModSecurity rule to block SQLi attempts against del_promote.php
SecRule REQUEST_URI "@contains /del_promote.php" \
"chain,deny,status:403,id:1010419,msg:'CVE-2025-10419 SQLi attempt'"
SecRule ARGS:sy "@rx (?i)(union|select|--|';|or\s+1=1|information_schema)" "t:none,t:urlDecodeUni"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
