CVE-2025-5971: School Fees Payment System SQLi Flaw

CVE-2025-5971 Overview

CVE-2025-5971 is a SQL injection vulnerability in code-projects School Fees Payment System 1.0, developed by Fabian. The flaw resides in the /ajx.php endpoint, where the name_startsWith parameter is passed to the backend database without proper sanitization. An authenticated remote attacker can manipulate the parameter to inject arbitrary SQL statements. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed instances. The weakness is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Improper Neutralization of Special Elements in Output).

Critical Impact
Remote attackers with low-level privileges can inject SQL through /ajx.php to read or modify database contents in the School Fees Payment System.

Affected Products

Fabian School Fees Payment System 1.0
Component: /ajx.php
Vulnerable parameter: name_startsWith

Discovery Timeline

2025-06-10 - CVE-2025-5971 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5971

Vulnerability Analysis

The vulnerability exists in the /ajx.php script of the School Fees Payment System. The script accepts user-supplied input through the name_startsWith parameter, typically used to support autocomplete or search-as-you-type functionality. The application concatenates this parameter directly into a SQL query without parameterization or escaping. An attacker can break out of the intended query context and append arbitrary SQL syntax. Exploitation is possible remotely over the network and does not require complex preconditions.

The attack only requires low-level access to the application, which is consistent with a system designed to serve students, parents, and administrative staff. Successful exploitation can expose financial records, student identifiers, and payment data stored in the underlying database.

Root Cause

The root cause is missing input neutralization on the name_startsWith query parameter. The application constructs a dynamic SQL statement using string concatenation rather than prepared statements or parameter binding. PHP applications that pass $_GET or $_POST values directly into MySQL query strings are the recurring pattern behind [CWE-89]. No allowlist validation, type casting, or escaping is applied before the value reaches the SQL engine.

Attack Vector

The attack vector is network-based through standard HTTP requests. An attacker sends a crafted GET or POST request to /ajx.php with a malicious payload in the name_startsWith parameter. Typical payloads use UNION-based or boolean-based techniques to extract data, including credentials hashed in administrative tables. Because the exploit is public, automated scanners and opportunistic actors can incorporate it into broader campaigns against exposed deployments. Refer to the VulDB entry #311847 and the GitHub Issue Report for technical details on the disclosed exploitation path.

Detection Methods for CVE-2025-5971

Indicators of Compromise

HTTP requests to /ajx.php containing SQL meta-characters in the name_startsWith parameter, such as ', ", --, UNION, SELECT, or SLEEP(
Repeated requests to /ajx.php from a single source within short time windows, consistent with automated SQLi tooling
Database error messages returned in HTTP responses referencing MySQL syntax errors
Unexpected outbound database reads or large response payloads from the /ajx.php endpoint

Detection Strategies

Inspect web server access logs for name_startsWith values containing URL-encoded SQL syntax such as %27, %20UNION%20, or %20OR%201%3D1
Deploy web application firewall (WAF) signatures tuned to SQL injection patterns on the /ajx.php route
Correlate application logs with database query logs to identify malformed or unusually long SQL statements

Monitoring Recommendations

Enable MySQL general query logging temporarily during incident response to capture injected payloads
Alert on HTTP 500 responses originating from /ajx.php, which often indicate SQL syntax probing
Monitor for known SQLi scanner User-Agent strings such as sqlmap, Havij, or empty/randomized User-Agents targeting the endpoint

How to Mitigate CVE-2025-5971

Immediate Actions Required

Restrict public network access to the School Fees Payment System until a fix is applied; place it behind VPN or IP allowlisting
Deploy WAF rules that block SQL meta-characters in the name_startsWith parameter on /ajx.php
Rotate database credentials and review database accounts for unexpected privilege changes or new entries
Audit recent access logs for evidence of exploitation attempts referencing the GitHub Issue Report disclosure

Patch Information

No vendor patch has been published in the references available for CVE-2025-5971. The product is distributed through code-projects.org as source code, so administrators must apply source-level fixes. Replace dynamic SQL construction in /ajx.php with parameterized queries using mysqli_prepare() or PDO prepared statements with bound parameters. Validate name_startsWith against an allowlist of expected characters before it reaches the database layer.

Workarounds

Modify /ajx.php to cast or sanitize name_startsWith using mysqli_real_escape_string() as a temporary measure, while migrating to prepared statements
Apply least-privilege principles to the MySQL account used by the application, removing FILE, DROP, and write privileges where not required
Disable the autocomplete or search functionality that depends on /ajx.php if it is not business-critical
Consider migrating to a maintained school fees management platform, since code-projects releases are educational projects without a formal security response process

bash

# Configuration example: minimal nginx rule to block SQLi patterns on /ajx.php
location = /ajx.php {
    if ($args ~* "(union.*select|select.*from|--|\bor\b\s+1=1|sleep\s*\()") {
        return 403;
    }
    # forward legitimate traffic to PHP-FPM
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}