CVE-2025-14566: Kidaze CourseSelectionSystem SQLi Flaw

CVE-2025-14566 Overview

A SQL injection vulnerability has been identified in kidaze CourseSelectionSystem up to commit 42cd892b40a18d50bd4ed1905fa89f939173a464. The vulnerability exists in an unknown function within the file /Profilers/SProfile/reg.php, where manipulation of the USN argument enables SQL injection attacks. This flaw can be exploited remotely, and exploit code has been publicly released, increasing the risk of active exploitation.

Critical Impact

Attackers can exploit this SQL injection vulnerability to extract, modify, or delete sensitive data from the database, potentially compromising student records, course information, and user credentials stored in the CourseSelectionSystem.

Affected Products

• kidaze CourseSelectionSystem (all versions up to commit 42cd892b40a18d50bd4ed1905fa89f939173a464)

Discovery Timeline

• 2025-12-12 - CVE-2025-14566 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2025-14566

Vulnerability Analysis

This SQL injection vulnerability arises from improper handling of user-supplied input in the /Profilers/SProfile/reg.php file. When processing the USN parameter, the application fails to properly sanitize or parameterize the input before incorporating it into SQL queries. This allows attackers to inject arbitrary SQL commands that execute within the context of the database.

The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). These weaknesses indicate that the application does not adequately validate or escape user input before passing it to the database layer.

Root Cause

The root cause of this vulnerability is the lack of input validation and the use of unsanitized user input in SQL query construction. The USN parameter is directly incorporated into database queries without proper parameterization or escaping, allowing attackers to manipulate the query structure. This is a common pattern in legacy PHP applications that use string concatenation to build SQL statements rather than prepared statements with parameterized queries.

Attack Vector

The attack is network-based, requiring no authentication or user interaction. An attacker can craft malicious HTTP requests to the vulnerable endpoint /Profilers/SProfile/reg.php, injecting SQL payloads through the USN parameter. The attack can be executed remotely, making it accessible to any threat actor with network access to the application.

The exploitation typically involves sending specially crafted values in the USN parameter that break out of the intended query context and execute arbitrary SQL commands. Common attack techniques include UNION-based injection for data extraction, time-based blind injection for data enumeration, and stacked queries for data modification or deletion.

For detailed technical information about this vulnerability, see the GitHub Issue on CVE and VulDB #336190.

Detection Methods for CVE-2025-14566

Indicators of Compromise

• Unusual HTTP requests to /Profilers/SProfile/reg.php containing SQL syntax characters such as single quotes, double dashes, or UNION keywords in the USN parameter
• Database error messages in application logs indicating SQL syntax errors or unexpected query results
• Anomalous database queries in database audit logs, particularly those involving system tables or bulk data extraction
• Increased response times for requests to the affected endpoint, potentially indicating time-based blind SQL injection attempts

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in requests targeting /Profilers/SProfile/reg.php
• Implement application-level logging for all requests to the vulnerable endpoint, capturing full request parameters for forensic analysis
• Configure database query monitoring to alert on anomalous query patterns, including attempts to access system tables or excessive data retrieval
• Use intrusion detection systems (IDS) with signatures for common SQL injection attack patterns

Monitoring Recommendations

• Enable verbose logging on web servers to capture detailed request information for the affected endpoint
• Monitor database connection pools for unusual activity or connection exhaustion that may indicate exploitation attempts
• Establish baseline metrics for normal application behavior and alert on deviations that could indicate active exploitation
• Review access logs regularly for patterns consistent with automated SQL injection scanning tools

How to Mitigate CVE-2025-14566

Immediate Actions Required

• Restrict network access to the affected endpoint /Profilers/SProfile/reg.php using firewall rules or access control lists where possible
• Deploy a Web Application Firewall with SQL injection protection rules in front of the CourseSelectionSystem application
• Implement input validation at the application level to reject requests containing SQL injection payloads
• Review and audit database user permissions to ensure the application uses least-privilege database accounts

Patch Information

No official vendor patch has been identified for this vulnerability. The affected software is maintained at a specific Git commit (42cd892b40a18d50bd4ed1905fa89f939173a464), and users should monitor the project repository for security updates. For the latest vulnerability information, refer to VulDB CTI ID #336190.

Workarounds

• Implement prepared statements with parameterized queries in the affected PHP file to prevent SQL injection
• Add input validation to sanitize the USN parameter, rejecting any values containing SQL metacharacters
• Deploy network-level access controls to limit exposure of the CourseSelectionSystem to trusted networks only
• Consider disabling or removing the vulnerable functionality if it is not critical to operations until a proper fix is available

To remediate the vulnerability at the code level, modify the /Profilers/SProfile/reg.php file to use PDO prepared statements or mysqli parameterized queries instead of direct string interpolation. All database queries accepting the USN parameter should bind this value as a parameter rather than concatenating it into the query string.