CVE-2025-10477: Kidaze CourseSelectionSystem SQLi Flaw

CVE-2025-10477 Overview

A SQL injection vulnerability has been identified in kidaze CourseSelectionSystem up to commit 42cd892b40a18d50bd4ed1905fa89f939173a464. The vulnerability exists in an unknown function within the file /Profilers/PriProfile/eligibility.php, where improper handling of the Branch parameter allows attackers to inject malicious SQL statements. This flaw can be exploited remotely by authenticated users to manipulate database queries, potentially leading to unauthorized data access, modification, or deletion.

Critical Impact
Remote attackers with low privileges can exploit this SQL injection vulnerability to access, modify, or delete sensitive data in the underlying database. The exploit is publicly available, increasing the risk of active exploitation.

Affected Products

kidaze courseselectionsystem (up to commit 42cd892b40a18d50bd4ed1905fa89f939173a464)

Discovery Timeline

September 15, 2025 - CVE-2025-10477 published to NVD
October 17, 2025 - Last updated in NVD database

Technical Details for CVE-2025-10477

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) stems from improper neutralization of special elements used in SQL commands within the eligibility.php file. The application fails to properly validate or sanitize user-supplied input through the Branch parameter before incorporating it into SQL queries. This allows attackers to inject arbitrary SQL code that gets executed by the database server with the same privileges as the application's database user.

The vulnerability also falls under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), highlighting the broader issue of injection vulnerabilities in the codebase. The product does not use semantic versioning, making it difficult to identify specific affected or patched releases.

Root Cause

The root cause of this vulnerability is the lack of proper input validation and parameterized queries in the /Profilers/PriProfile/eligibility.php file. The Branch argument is directly concatenated or interpolated into SQL queries without sanitization, prepared statements, or parameterized queries. This fundamental coding flaw allows user-controlled input to alter the structure and intent of SQL statements executed against the backend database.

Attack Vector

The attack can be launched remotely over the network by authenticated users with low privileges. An attacker needs to manipulate the Branch parameter in requests to the /Profilers/PriProfile/eligibility.php endpoint to inject malicious SQL payloads. Common exploitation techniques include:

UNION-based injection: Combining query results with data from other tables
Boolean-based blind injection: Inferring data through true/false responses
Time-based blind injection: Extracting data through deliberate time delays
Error-based injection: Leveraging database error messages to extract information

The exploit is publicly documented and available, making it accessible to a wide range of threat actors. For technical details regarding the vulnerability, refer to the GitHub Issue Discussion and VulDB entry #323913.

Detection Methods for CVE-2025-10477

Indicators of Compromise

Unusual SQL error messages in application logs originating from /Profilers/PriProfile/eligibility.php
Web server access logs showing requests to eligibility.php with suspicious characters in the Branch parameter (e.g., single quotes, UNION statements, OR 1=1 patterns)
Database audit logs indicating unauthorized SELECT, INSERT, UPDATE, or DELETE operations
Unexpected database queries or stored procedure executions outside normal application behavior

Detection Strategies

Deploy Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in the Branch parameter
Implement intrusion detection system (IDS) signatures for SQL injection attack patterns targeting PHP applications
Monitor application error logs for SQL syntax errors or database exception messages
Configure database activity monitoring to alert on anomalous query patterns or data exfiltration attempts

Monitoring Recommendations

Enable verbose logging for the /Profilers/PriProfile/ directory to capture all incoming requests and parameters
Set up real-time alerting for any requests containing SQL keywords (UNION, SELECT, DROP, INSERT) in GET/POST parameters
Monitor database connection patterns for unusual activity from the web application user account
Review audit trails for any unauthorized data access or modifications in tables accessed by eligibility.php

How to Mitigate CVE-2025-10477

Immediate Actions Required

Restrict access to the /Profilers/PriProfile/eligibility.php endpoint until a patch is applied
Implement input validation at the web server level to filter malicious characters from the Branch parameter
Deploy WAF rules specifically targeting SQL injection attempts against this endpoint
Review database permissions and limit the application account to minimum required privileges
If possible, take the vulnerable functionality offline until code remediation is complete

Patch Information

No official patch has been released by the vendor at this time. The product does not use versioning, which complicates tracking of fixed releases. Organizations should monitor the VulDB submission #648516 and the vendor's repository for any security updates. The vulnerability affects all versions up to commit 42cd892b40a18d50bd4ed1905fa89f939173a464.

Workarounds

Implement a Web Application Firewall (WAF) with SQL injection detection rules in front of the application
Add server-side input validation to sanitize the Branch parameter before processing
Use prepared statements or parameterized queries if modifying the source code is possible
Limit database user permissions to read-only where full database access is not required
Consider network segmentation to restrict access to the application from untrusted networks

bash

# Example WAF rule for ModSecurity to block SQL injection attempts
SecRule ARGS:Branch "@detectSQLi" \
    "id:100001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'SQL Injection attempt detected in Branch parameter',\
    tag:'attack-sqli'"