CVE-2025-14967: Student Management System SQLi Vulnerability

CVE-2025-14967 Overview

A SQL injection vulnerability has been identified in itsourcecode Student Management System version 1.0. The vulnerability exists in the /candidates_report.php file, where improper handling of the school_year parameter allows attackers to inject malicious SQL statements. This vulnerability can be exploited remotely without authentication, potentially allowing unauthorized access to sensitive student data, manipulation of database records, or further compromise of the underlying system.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to extract sensitive student information, modify database contents, or potentially gain unauthorized access to the underlying database server. Educational institutions using this software should take immediate action.

Affected Products

• itsourcecode Student Management System 1.0
• angeljudesuarez student_management_system 1.0

Discovery Timeline

• December 19, 2025 - CVE-2025-14967 published to NVD
• December 24, 2025 - Last updated in NVD database

Technical Details for CVE-2025-14967

Vulnerability Analysis

This vulnerability represents a classic SQL injection flaw stemming from inadequate input validation in a PHP-based student management application. The affected endpoint /candidates_report.php accepts a school_year parameter that is directly incorporated into SQL queries without proper sanitization or parameterization.

When user-supplied input is concatenated directly into SQL statements, attackers can manipulate the query logic by injecting SQL syntax. In this case, the school_year parameter—which would normally accept values like "2024-2025"—can be exploited to inject arbitrary SQL commands that the database will execute with the application's privileges.

The exploit has been publicly disclosed, increasing the risk of widespread exploitation against unpatched installations. Educational institutions running this software are particularly at risk due to the sensitive nature of student data.

Root Cause

The root cause is the failure to implement proper input validation and parameterized queries (prepared statements) when handling the school_year parameter in the candidates report functionality. The application directly incorporates user input into SQL queries, violating secure coding practices for database interactions. This falls under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Attack Vector

The attack is network-based and can be executed remotely without requiring authentication. An attacker can craft malicious HTTP requests to the /candidates_report.php endpoint with a specially crafted school_year parameter containing SQL injection payloads.

The attacker sends the malicious request containing SQL syntax in the school_year parameter. The vulnerable application concatenates this input directly into a SQL query without sanitization. The database executes the modified query, potentially returning sensitive data, modifying records, or executing additional database commands depending on the injected payload.

For technical details and proof-of-concept information, refer to the GitHub CVE Issue Discussion and VulDB #337602.

Detection Methods for CVE-2025-14967

Indicators of Compromise

• HTTP requests to /candidates_report.php containing SQL syntax characters (single quotes, double dashes, UNION, SELECT, etc.) in the school_year parameter
• Database logs showing unusual or malformed queries originating from the student management application
• Unexpected database errors or application exceptions related to SQL syntax
• Evidence of data exfiltration or unauthorized database modifications in audit logs

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in requests to /candidates_report.php
• Enable detailed logging for the web application and database to capture suspicious query patterns
• Deploy intrusion detection systems (IDS) configured with SQL injection signature rules
• Monitor for anomalous data access patterns or bulk data retrieval from student-related database tables

Monitoring Recommendations

• Enable and review web server access logs for requests containing SQL injection indicators targeting the candidates report endpoint
• Configure database query logging to detect malformed or unauthorized queries
• Set up alerts for failed authentication attempts or unusual database activity patterns
• Regularly audit application logs for error messages indicating SQL syntax issues

How to Mitigate CVE-2025-14967

Immediate Actions Required

• Restrict network access to the Student Management System to trusted IP addresses only
• Disable or remove the /candidates_report.php functionality if not immediately required
• Implement a Web Application Firewall (WAF) with SQL injection protection rules
• Review database permissions and ensure the application uses least-privilege database accounts
• Monitor for any signs of exploitation in application and database logs

Patch Information

As of the last NVD update on December 24, 2025, no official patch has been released by the vendor. Organizations should monitor the IT Source Code website for security updates. In the absence of a vendor patch, implementing the workarounds below is strongly recommended.

For additional vulnerability details, consult VulDB CTI ID #337602.

Workarounds

• Implement input validation to restrict the school_year parameter to expected formats (e.g., YYYY-YYYY pattern)
• Modify the source code to use parameterized queries (prepared statements) instead of string concatenation for SQL queries
• Deploy a reverse proxy or WAF in front of the application to filter malicious requests
• Restrict database user permissions to the minimum required for application functionality
• Consider taking the application offline until proper remediation can be implemented

# Example WAF rule for ModSecurity to block SQL injection in school_year parameter
SecRule ARGS:school_year "@detectSQLi" \
    "id:100001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'SQL Injection attempt detected in school_year parameter - CVE-2025-14967'"