CVE-2025-4795: Schoolcms SQL Injection Vulnerability

CVE-2025-4795 Overview

CVE-2025-4795 is a SQL injection vulnerability in SchoolCMS 2.3.1 developed by gongfuxiang. The flaw resides in the SaveInfo function reachable through /index.php?m=Admin&c=article&a=SaveInfo. An attacker can manipulate the ID parameter to inject arbitrary SQL statements into the backend database query. The vulnerability is exploitable remotely over the network and requires high privileges within the application. Public disclosure of the exploit has occurred through the project issue tracker and VulDB. The weakness is categorized under [CWE-89] SQL Injection and [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Authenticated attackers can manipulate the ID parameter of the SaveInfo administrative endpoint to read, modify, or destroy data in the SchoolCMS database.

Affected Products

SchoolCMS 2.3.1
Component: Admin controller, article module
Endpoint: /index.php?m=Admin&c=article&a=SaveInfo

Discovery Timeline

2025-05-16 - CVE-2025-4795 published to NVD
2025-11-10 - Last updated in NVD database

Technical Details for CVE-2025-4795

Vulnerability Analysis

The vulnerability resides in the SaveInfo action of the article controller within the Admin module of SchoolCMS 2.3.1. The application accepts the ID parameter from an HTTP request and concatenates it into a SQL statement without sufficient sanitization or parameterization. An authenticated administrative user can submit crafted input that breaks out of the intended query context and appends attacker-controlled SQL fragments.

Exploitation requires existing administrative access to the application, which limits the attack surface but does not eliminate risk. Insider abuse, credential theft, and chained attacks against weaker administrative authentication can all reach this endpoint. Successful exploitation yields limited confidentiality, integrity, and availability impact against the backend database.

Root Cause

The root cause is improper neutralization of special elements in a SQL command [CWE-89]. The SaveInfo handler does not enforce strict typing on the ID parameter and fails to use prepared statements or parameter binding. Input flows directly from the HTTP request into a dynamic query string, allowing SQL syntax to be interpreted by the database engine. The broader weakness class is improper neutralization of output [CWE-74].

Attack Vector

The attack vector is network-based via HTTP. An authenticated attacker with administrative privileges sends a request to /index.php?m=Admin&c=article&a=SaveInfo with a crafted ID value. The injected payload can include UNION-based extraction queries, boolean-based blind techniques, or stacked statements depending on the underlying database driver. The exploit has been disclosed publicly through the GitHub Issue Tracker and the VulDB Analysis Report, increasing the likelihood of opportunistic exploitation.

No verified proof-of-concept code is reproduced here. Refer to the public disclosure references for technical payload details.

Detection Methods for CVE-2025-4795

Indicators of Compromise

HTTP requests to /index.php?m=Admin&c=article&a=SaveInfo containing SQL metacharacters such as ', ", --, UNION, SELECT, or SLEEP in the ID parameter
Unusual administrative session activity originating from unexpected source IP addresses or geographies
Web server access logs showing repeated requests to the SaveInfo endpoint with varying ID values consistent with blind SQL injection probing
Database error messages referencing the article table or syntax errors logged by the application

Detection Strategies

Deploy web application firewall rules that inspect the ID parameter on the SaveInfo endpoint for SQL injection patterns
Enable verbose database query logging and alert on syntactically invalid queries targeting the article table
Correlate administrative authentication events with subsequent calls to /index.php?m=Admin&c=article&a=SaveInfo to identify session abuse
Baseline normal administrative request patterns and alert on parameter values containing SQL keywords or encoded payloads

Monitoring Recommendations

Forward web server, application, and database logs to a centralized analytics platform for correlation
Alert on outbound database connections initiated by the web application process outside of normal operating patterns
Monitor the article table for unexpected schema changes, mass updates, or unauthorized record deletions
Track administrative account logins and flag deviations from established access baselines

How to Mitigate CVE-2025-4795

Immediate Actions Required

Restrict network access to the SchoolCMS administrative interface using IP allowlists, VPN, or reverse proxy authentication
Rotate administrative credentials and enforce multi-factor authentication on all admin accounts
Audit application and database logs for prior exploitation attempts against the SaveInfo endpoint
Review the integrity of the article table and related records for unauthorized modifications

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2025-4795 at the time of publication. Track the GitHub Issue Tracker and the upstream gongfuxiang/schoolcms repository for a fixed release. If the project remains unpatched, evaluate migration to a maintained content management system.

Workarounds

Apply a web application firewall rule that blocks non-numeric values in the ID parameter of /index.php?m=Admin&c=article&a=SaveInfo
Modify the SaveInfo handler in source to cast ID to an integer before use in any SQL statement
Replace dynamic query construction with prepared statements and parameter binding throughout the article controller
Disable the administrative article module if it is not in active use until a vendor fix is available

bash

# Example nginx configuration to block non-numeric ID values on the vulnerable endpoint
location = /index.php {
    if ($arg_m = "Admin") {
        if ($arg_c = "article") {
            if ($arg_a = "SaveInfo") {
                if ($arg_ID !~ "^[0-9]+$") {
                    return 403;
                }
            }
        }
    }
    fastcgi_pass unix:/run/php/php-fpm.sock;
}