CVE-2025-10594: Janobe Student File System SQLi Flaw

CVE-2025-10594 Overview

CVE-2025-10594 is a SQL injection vulnerability in SourceCodester Online Student File Management System 1.0, developed by Janobe. The flaw resides in the /admin/delete_student.php endpoint, where the stud_id parameter is passed unsanitized into a backend SQL query. Remote attackers with low-privilege access can manipulate this parameter to alter query logic and access or modify database records. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against deployed instances. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated attackers can inject arbitrary SQL through the stud_id parameter in /admin/delete_student.php, exposing student records and administrative data stored in the application database.

Affected Products

Janobe Online Student File Management System 1.0
SourceCodester distribution of Online Student File Management System
Deployments using the vulnerable /admin/delete_student.php handler

Discovery Timeline

2025-09-17 - CVE-2025-10594 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10594

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input in the administrative delete workflow. The delete_student.php script accepts a stud_id argument over HTTP and concatenates it directly into a SQL statement. Because the application does not use parameterized queries or input sanitization, attacker-controlled characters such as quotes, comments, and UNION clauses are interpreted by the database engine. The EPSS probability is 0.311% with a percentile of 22.564, indicating moderate predicted exploitation likelihood compared to typical disclosures.

Root Cause

The root cause is direct string concatenation of the stud_id request parameter into a SQL DELETE query without prepared statements or input validation. The PHP handler treats user input as trusted SQL syntax. This violates secure coding practices for database access and falls under [CWE-74] injection weaknesses.

Attack Vector

The attack is launched remotely over the network against the admin interface. An authenticated user with low privileges sends a crafted HTTP request to /admin/delete_student.php with a malicious stud_id value. Payloads typically include boolean-based, time-based, or UNION-based SQL injection techniques to extract or modify records. No user interaction is required beyond submitting the request. Refer to the GitHub Issue Discussion and VulDB Entry #324611 for additional technical detail.

Detection Methods for CVE-2025-10594

Indicators of Compromise

HTTP requests to /admin/delete_student.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or OR 1=1 in the stud_id parameter
Unexpected DELETE operations or row-count anomalies in the student records database table
Web server access logs showing repeated requests to delete_student.php from a single source within a short window
Database error messages returned to clients referencing SQL syntax around the stud_id value

Detection Strategies

Deploy a web application firewall rule that inspects the stud_id parameter for SQL injection signatures and blocks non-numeric values
Enable database query logging and alert on DELETE statements originating from the application user that exceed normal baselines
Correlate authentication logs with administrative endpoint access to identify abuse of low-privilege admin accounts

Monitoring Recommendations

Forward web server, PHP error, and database logs to a centralized analytics platform for correlation against injection patterns
Monitor for outbound database errors or stack traces returned in HTTP responses, which indicate failed injection attempts
Track administrative session activity for anomalous parameter tampering on /admin/ endpoints

How to Mitigate CVE-2025-10594

Immediate Actions Required

Restrict network access to the /admin/ directory to trusted IP ranges or VPN-only access until a patch is applied
Rotate administrative credentials and audit all admin accounts for unauthorized access
Review database contents for unauthorized modifications or deletions of student records
Deploy WAF rules that enforce numeric-only validation on the stud_id parameter

Patch Information

No official vendor patch is currently listed in the NVD references. Operators should monitor the SourceCodester Resource and the VulDB CTI ID #324611 entry for fix availability. Until a patch is released, administrators must apply manual code fixes to enforce prepared statements in delete_student.php.

Workarounds

Modify delete_student.php to use parameterized queries via PDO or mysqli_prepare() with bound parameters
Add server-side validation that casts stud_id to an integer before any database interaction
Disable the affected endpoint via web server rewrite rules if the delete functionality is not in active use
Place the application behind a reverse proxy with input filtering for SQL metacharacters

bash

# Example Apache rule to enforce numeric stud_id values
<Location "/admin/delete_student.php">
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (^|&)stud_id=([^0-9&]|$) [NC]
    RewriteRule .* - [F,L]
</Location>