CVE-2025-10665: Kidaze CourseSelectionSystem SQLi Flaw

CVE-2025-10665 Overview

A SQL injection vulnerability has been identified in Kidaze CourseSelectionSystem up to commit 42cd892b40a18d50bd4ed1905fa89f939173a464. The vulnerability exists in the file /Profilers/PProfile/COUNT3s3.php, where manipulation of the csem argument allows attackers to inject malicious SQL commands. This vulnerability can be exploited remotely, and a public exploit is reportedly available, increasing the risk of active exploitation in the wild.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to potentially read, modify, or delete database contents, compromise application data integrity, and potentially escalate to further system access through database-level exploitation techniques.

Affected Products

• Kidaze CourseSelectionSystem (all versions up to commit 42cd892b40a18d50bd4ed1905fa89f939173a464)

Discovery Timeline

• September 18, 2025 - CVE-2025-10665 published to NVD
• October 8, 2025 - Last updated in NVD database

Technical Details for CVE-2025-10665

Vulnerability Analysis

This vulnerability falls under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), commonly known as injection. The affected component is the /Profilers/PProfile/COUNT3s3.php file, which processes the csem parameter without adequate input sanitization. When user-supplied data is directly concatenated into SQL queries without proper parameterization or escaping, attackers can manipulate the query logic to access unauthorized data or execute arbitrary database commands.

The vulnerability is exploitable over the network, requiring low-privilege authentication but no user interaction. This makes it particularly dangerous in multi-user course selection systems where authenticated students or staff could potentially exploit the flaw to access other users' data or manipulate course enrollment records.

Root Cause

The root cause of this vulnerability is improper input validation and lack of parameterized queries in the COUNT3s3.php file. The csem parameter appears to be directly incorporated into SQL statements without adequate sanitization, allowing special characters and SQL syntax to be interpreted as part of the query rather than as literal data values. This is a classic example of trusting user input in database operations, a fundamental security anti-pattern.

Attack Vector

The attack vector is network-based, allowing remote exploitation. An authenticated attacker can craft malicious input for the csem parameter that includes SQL metacharacters and commands. When the application processes this input, the injected SQL code is executed against the database with the privileges of the application's database user.

Typical SQL injection attack patterns that may be effective include:

• Union-based injection to extract data from other tables
• Boolean-based blind injection to enumerate database contents
• Time-based blind injection for scenarios where direct output is not visible
• Error-based injection to extract information through database error messages

The vulnerability allows attackers to potentially access sensitive student information, course data, and other records stored in the database. For technical details and exploit information, refer to the GitHub CVE Issue Tracker and VulDB entry #324786.

Detection Methods for CVE-2025-10665

Indicators of Compromise

• Unusual SQL error messages appearing in application logs, particularly those referencing the COUNT3s3.php file
• Anomalous database queries containing UNION, SELECT, or other SQL keywords in the csem parameter
• Unexpected database access patterns or data exfiltration indicators
• Web server logs showing requests to /Profilers/PProfile/COUNT3s3.php with suspicious parameter values

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the csem parameter
• Implement database activity monitoring to identify unusual query patterns or unauthorized data access
• Configure application logging to capture all requests to the vulnerable endpoint with full parameter details
• Use intrusion detection systems (IDS) with SQL injection signature detection enabled

Monitoring Recommendations

• Monitor database logs for queries with SQL injection signatures such as single quotes, UNION statements, or comment sequences
• Set up alerts for failed authentication attempts or privilege escalation activities following interaction with the vulnerable endpoint
• Review web server access logs regularly for patterns indicating automated SQL injection scanning tools

How to Mitigate CVE-2025-10665

Immediate Actions Required

• Restrict network access to the CourseSelectionSystem application to trusted users and networks only
• Implement input validation on the csem parameter to reject malicious characters and patterns
• Deploy a Web Application Firewall (WAF) with SQL injection protection rules in front of the application
• Review database user privileges to ensure the application uses least-privilege access

Patch Information

Kidaze CourseSelectionSystem follows a rolling release model, so no specific versioned patch is available. Organizations should monitor the project repository for commits addressing this SQL injection vulnerability. Check the VulDB submission #651941 for updates on remediation status. Until an official fix is released, implementing the workarounds below is strongly recommended.

Workarounds

• Implement server-side input validation to sanitize the csem parameter, rejecting SQL metacharacters such as single quotes, double dashes, and semicolons
• Use prepared statements or parameterized queries in the application code as a defense-in-depth measure
• Deploy a reverse proxy or WAF to filter malicious requests before they reach the application
• Consider disabling or restricting access to the /Profilers/PProfile/COUNT3s3.php endpoint if it is not critical to operations

# Example WAF rule for ModSecurity to block SQL injection in csem parameter
SecRule ARGS:csem "@detectSQLi" \
    "id:100001,\
    phase:2,\
    deny,\
    status:403,\
    msg:'SQL Injection attempt detected in csem parameter',\
    log,\
    auditlog"