CVE-2025-10481: Janobe Student File Management SQLi Flaw

CVE-2025-10481 Overview

CVE-2025-10481 is a SQL injection vulnerability in the Janobe (SourceCodester) Online Student File Management System 1.0. The flaw resides in the /remove_file.php script, where the ID parameter is passed directly into a database query without proper sanitization. Authenticated remote attackers can manipulate the ID argument to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed installations. The vulnerability maps to CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Improper Neutralization of Special Elements in Output).

Critical Impact
Authenticated remote attackers can manipulate database queries through /remove_file.php, enabling unauthorized data access, modification, or deletion within the application database.

Affected Products

Janobe Online Student File Management System 1.0
SourceCodester Online Student File Management System 1.0
Vulnerable script: /remove_file.php

Discovery Timeline

2025-09-15 - CVE-2025-10481 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10481

Vulnerability Analysis

The vulnerability exists in the /remove_file.php endpoint of the Online Student File Management System. The script accepts an ID parameter through an HTTP request and concatenates the value directly into a SQL DELETE or SELECT statement. Because the application does not validate or parameterize the input, attackers can append SQL syntax to alter the query's logic.

Exploitation requires low privileges (PR:L) and no user interaction. The attack vector is the network, meaning any reachable instance with valid low-tier credentials is exposed. Impact is limited to the application database scope, but successful injection still permits reading, modifying, or destroying records the database user can touch.

The vulnerability is tracked publicly through GitHub CVE Issue #10 and VulDB Report #323916. EPSS data places the probability of observed exploitation at 0.385%.

Root Cause

The root cause is the absence of prepared statements or input sanitization on the ID parameter. The PHP code passes user-controlled input directly into the SQL query string. Standard defenses such as mysqli prepared statements with bound parameters or PDO with placeholders are not used.

Attack Vector

An authenticated attacker sends a crafted HTTP request to /remove_file.php with a malicious ID value. By appending SQL operators, conditional clauses, or UNION SELECT payloads, the attacker can extract data from arbitrary tables or modify the deletion scope. The vulnerability does not require administrator privileges, only an account that can reach the endpoint.

No verified proof-of-concept code is published in the referenced advisories beyond the parameter location. Refer to the VulDB CTI Report #323916 for additional technical context.

Detection Methods for CVE-2025-10481

Indicators of Compromise

HTTP requests to /remove_file.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or ; in the ID parameter.
Unusual DELETE or SELECT activity in MySQL query logs originating from the application database user.
Unexpected file or record removals from the student file management tables.
Web server access logs showing repeated requests to /remove_file.php with varying or encoded ID values.

Detection Strategies

Inspect web access logs for non-numeric values supplied to the ID parameter on /remove_file.php.
Deploy a Web Application Firewall (WAF) rule set such as OWASP ModSecurity Core Rule Set to flag SQL injection signatures targeting this endpoint.
Enable MySQL general or audit logging and correlate suspicious queries against application request timestamps.

Monitoring Recommendations

Alert on HTTP 500 responses from /remove_file.php, which often indicate failed injection attempts.
Monitor for spikes in database error messages referencing syntax errors near the ID value.
Track authenticated session activity that issues requests to file removal endpoints outside normal user workflows.

How to Mitigate CVE-2025-10481

Immediate Actions Required

Restrict network access to the Online Student File Management System until a patch is applied, exposing it only to trusted networks or behind a VPN.
Apply a WAF rule blocking SQL metacharacters in the ID parameter of /remove_file.php.
Rotate database credentials and review the application database account's privileges, ensuring it cannot access tables outside its required scope.
Audit recent records in the file management tables for unauthorized deletions or modifications.

Patch Information

No official vendor patch has been published for Janobe Online Student File Management System 1.0 at the time of NVD publication. Administrators should monitor SourceCodester for updates and consider replacing the application if no fix becomes available.

Workarounds

Modify /remove_file.php to use parameterized queries with mysqli_prepare() or PDO prepared statements before passing ID into SQL.
Cast the ID parameter to an integer using intval($_GET['ID']) or filter_var($_GET['ID'], FILTER_VALIDATE_INT) before query construction.
Enforce least-privilege on the database account by removing DROP, ALTER, and cross-table SELECT rights where not required.
Disable or remove the /remove_file.php endpoint if the file removal feature is not actively used.

bash

# Example PHP remediation using PDO prepared statements
$id = filter_var($_GET['ID'], FILTER_VALIDATE_INT);
if ($id === false) {
    http_response_code(400);
    exit('Invalid ID');
}
$stmt = $pdo->prepare('DELETE FROM student_files WHERE id = :id');
$stmt->bindParam(':id', $id, PDO::PARAM_INT);
$stmt->execute();