CVE-2025-10477: Kidaze CourseSelectionSystem SQLi Flaw

CVE-2025-10477 Overview

A SQL injection vulnerability has been identified in kidaze CourseSelectionSystem up to commit 42cd892b40a18d50bd4ed1905fa89f939173a464. The vulnerability exists in an unknown function within the file /Profilers/PriProfile/eligibility.php, where improper handling of the Branch parameter allows attackers to inject malicious SQL statements. This flaw can be exploited remotely by authenticated users to manipulate database queries, potentially leading to unauthorized data access, modification, or deletion.

Critical Impact

Remote attackers with low privileges can exploit this SQL injection vulnerability to access, modify, or delete sensitive data in the underlying database. The exploit is publicly available, increasing the risk of active exploitation.

Affected Products

• kidaze courseselectionsystem (up to commit 42cd892b40a18d50bd4ed1905fa89f939173a464)

Discovery Timeline

• September 15, 2025 - CVE-2025-10477 published to NVD
• October 17, 2025 - Last updated in NVD database

Technical Details for CVE-2025-10477

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) stems from improper neutralization of special elements used in SQL commands within the eligibility.php file. The application fails to properly validate or sanitize user-supplied input through the Branch parameter before incorporating it into SQL queries. This allows attackers to inject arbitrary SQL code that gets executed by the database server with the same privileges as the application's database user.

The vulnerability also falls under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), highlighting the broader issue of injection vulnerabilities in the codebase. The product does not use semantic versioning, making it difficult to identify specific affected or patched releases.

Root Cause

The root cause of this vulnerability is the lack of proper input validation and parameterized queries in the /Profilers/PriProfile/eligibility.php file. The Branch argument is directly concatenated or interpolated into SQL queries without sanitization, prepared statements, or parameterized queries. This fundamental coding flaw allows user-controlled input to alter the structure and intent of SQL statements executed against the backend database.

Attack Vector

The attack can be launched remotely over the network by authenticated users with low privileges. An attacker needs to manipulate the Branch parameter in requests to the /Profilers/PriProfile/eligibility.php endpoint to inject malicious SQL payloads. Common exploitation techniques include:

• UNION-based injection: Combining query results with data from other tables
• Boolean-based blind injection: Inferring data through true/false responses
• Time-based blind injection: Extracting data through deliberate time delays
• Error-based injection: Leveraging database error messages to extract information

The exploit is publicly documented and available, making it accessible to a wide range of threat actors. For technical details regarding the vulnerability, refer to the GitHub Issue Discussion and VulDB entry #323913.

Detection Methods for CVE-2025-10477

Indicators of Compromise

• Unusual SQL error messages in application logs originating from /Profilers/PriProfile/eligibility.php
• Web server access logs showing requests to eligibility.php with suspicious characters in the Branch parameter (e.g., single quotes, UNION statements, OR 1=1 patterns)
• Database audit logs indicating unauthorized SELECT, INSERT, UPDATE, or DELETE operations
• Unexpected database queries or stored procedure executions outside normal application behavior

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in the Branch parameter
• Implement intrusion detection system (IDS) signatures for SQL injection attack patterns targeting PHP applications
• Monitor application error logs for SQL syntax errors or database exception messages
• Configure database activity monitoring to alert on anomalous query patterns or data exfiltration attempts

Monitoring Recommendations

• Enable verbose logging for the /Profilers/PriProfile/ directory to capture all incoming requests and parameters
• Set up real-time alerting for any requests containing SQL keywords (UNION, SELECT, DROP, INSERT) in GET/POST parameters
• Monitor database connection patterns for unusual activity from the web application user account
• Review audit trails for any unauthorized data access or modifications in tables accessed by eligibility.php

How to Mitigate CVE-2025-10477

Immediate Actions Required

• Restrict access to the /Profilers/PriProfile/eligibility.php endpoint until a patch is applied
• Implement input validation at the web server level to filter malicious characters from the Branch parameter
• Deploy WAF rules specifically targeting SQL injection attempts against this endpoint
• Review database permissions and limit the application account to minimum required privileges
• If possible, take the vulnerable functionality offline until code remediation is complete

Patch Information

No official patch has been released by the vendor at this time. The product does not use versioning, which complicates tracking of fixed releases. Organizations should monitor the VulDB submission #648516 and the vendor's repository for any security updates. The vulnerability affects all versions up to commit 42cd892b40a18d50bd4ed1905fa89f939173a464.

Workarounds

• Implement a Web Application Firewall (WAF) with SQL injection detection rules in front of the application
• Add server-side input validation to sanitize the Branch parameter before processing
• Use prepared statements or parameterized queries if modifying the source code is possible
• Limit database user permissions to read-only where full database access is not required
• Consider network segmentation to restrict access to the application from untrusted networks

# Example WAF rule for ModSecurity to block SQL injection attempts
SecRule ARGS:Branch "@detectSQLi" \
    "id:100001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'SQL Injection attempt detected in Branch parameter',\
    tag:'attack-sqli'"