CVE-2025-13555: Campcodes School File Management SQLI

CVE-2025-13555 Overview

CVE-2025-13555 is a SQL injection vulnerability in Campcodes School File Management System 1.0. The flaw affects the login component reachable through /index.php, where the stud_no parameter is incorporated into a database query without proper sanitization. Attackers can exploit the issue remotely without authentication or user interaction. Public exploit details have been released, increasing the likelihood of opportunistic attacks against exposed installations. The vulnerability is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command) and [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can manipulate the stud_no parameter on the login page to inject SQL statements, enabling potential disclosure or modification of database contents.

Affected Products

Campcodes School File Management System 1.0
Component: Login handler in /index.php
Parameter: stud_no

Discovery Timeline

2025-11-23 - CVE-2025-13555 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-13555

Vulnerability Analysis

The vulnerability resides in the login workflow of Campcodes School File Management System 1.0. The /index.php endpoint accepts a stud_no parameter during authentication and passes the value into a backend SQL query without parameterization or input validation. An attacker can submit crafted input containing SQL metacharacters to alter the query logic.

Successful exploitation can yield unauthorized data retrieval, authentication bypass, or modification of records stored in the application database. Because the endpoint is exposed at the application's entry point, exploitation requires only network reachability to the affected web server. No user interaction or prior credentials are needed.

The EPSS forecast indicates a low near-term exploitation probability, but the public availability of the exploit description increases the practical risk for internet-exposed deployments.

Root Cause

The root cause is improper neutralization of user-controlled input ([CWE-89]). The stud_no value supplied during login is concatenated into an SQL statement rather than bound through prepared statements. The absence of input validation and parameterized queries allows an attacker to break out of the intended string context and append arbitrary SQL clauses.

Attack Vector

The attack vector is network-based. An attacker sends an HTTP request to /index.php containing a malicious stud_no value. Typical exploitation includes appending boolean conditions, UNION-based payloads, or time-based blind injection payloads to enumerate database structure and extract data. Because the issue is in the login handler, authentication is not required to reach the vulnerable code path.

No verified proof-of-concept code is available from a trusted source. Technical discussion is referenced in the GitHub CVE Issue Discussion and the VulDB entry #333322.

Detection Methods for CVE-2025-13555

Indicators of Compromise

HTTP POST or GET requests to /index.php containing SQL metacharacters (', ", --, ;, UNION, SELECT) in the stud_no parameter.
Anomalous login activity from a single source IP with high request volume targeting the stud_no field.
Database error messages returned in HTTP responses indicating malformed queries from the login endpoint.
Unusual outbound data flows or unexpected database read patterns coincident with login traffic.

Detection Strategies

Inspect web server access logs for stud_no parameter values containing SQL syntax tokens or URL-encoded equivalents (%27, %22, %3B).
Deploy web application firewall (WAF) signatures targeting SQL injection payloads against the login endpoint.
Correlate login failures with subsequent application errors to identify probing attempts.
Use database query monitoring to flag queries originating from the login workflow that include unexpected clauses.

Monitoring Recommendations

Forward web server, application, and database logs to a centralized analytics platform for correlation.
Alert on repeated requests to /index.php from a single source containing SQL keywords in form fields.
Track baseline query volumes and structures from the application service account to detect deviations.

How to Mitigate CVE-2025-13555

Immediate Actions Required

Restrict public exposure of the Campcodes School File Management System 1.0 application until a fix is applied.
Deploy WAF rules to block SQL injection payloads against the stud_no parameter on /index.php.
Audit application logs for evidence of prior exploitation, including unexpected database errors or anomalous login patterns.
Rotate database credentials and review user records if exploitation indicators are found.

Patch Information

No vendor patch has been published in the references available at the time of writing. Refer to the CampCodes Security Resource and the VulDB advisory for status updates. Until a vendor fix is released, mitigations must rely on compensating controls.

Workarounds

Modify the affected login query to use parameterized statements or prepared queries in the underlying PHP code if source-level changes are feasible.
Apply server-side input validation that rejects non-numeric or unexpected characters in the stud_no field before query execution.
Place the application behind a reverse proxy with strict request filtering and rate limiting on the login endpoint.
Limit database account privileges used by the application to read-only or minimum required operations to reduce post-exploitation impact.

bash

# Example ModSecurity rule to block SQL metacharacters in stud_no
SecRule ARGS:stud_no "@rx (?i)(\\'|\"|--|;|union\\s+select|or\\s+1=1)" \
    "id:1005551,phase:2,deny,status:403,log,msg:'Possible SQLi in stud_no (CVE-2025-13555)'"