CVE-2025-67404: CASAP Enrollment System SQLi Vulnerability

CVE-2025-67404 Overview

CVE-2025-67404 is a SQL injection vulnerability in Sourcecodester CASAP Automated Enrollment System 1.0. The flaw resides in the save_stud.php endpoint, which fails to sanitize the fname, lname, and student_class parameters before incorporating them into SQL statements. Unauthenticated remote attackers can inject arbitrary SQL to read, modify, or delete records in the enrollment database. The weakness is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Remote, unauthenticated attackers can execute arbitrary SQL against the backend database, resulting in full compromise of confidentiality, integrity, and availability of student enrollment data.

Affected Products

Sourcecodester CASAP Automated Enrollment System 1.0
save_stud.php endpoint (vulnerable script)
Deployments exposing the enrollment application to untrusted networks

Discovery Timeline

2026-07-29 - CVE-2025-67404 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-67404

Vulnerability Analysis

The vulnerability affects the student registration workflow in the CASAP Automated Enrollment System. When a POST request is submitted to save_stud.php, the application takes the fname, lname, and student_class parameters directly from user input and concatenates them into an INSERT SQL statement. No parameterization, prepared statements, or input escaping is performed. Attackers can therefore break out of the string context and append arbitrary SQL clauses.

Because the endpoint is reachable without authentication, exploitation requires only network access to the web application. Successful injection allows attackers to enumerate database contents, exfiltrate credentials, tamper with enrollment records, or drop tables. Depending on database privileges, attackers may also read local files or write files to the web root, escalating from data theft to remote code execution.

Root Cause

The root cause is failure to separate code from data in database queries [CWE-89]. The PHP handler concatenates request parameters into SQL statements rather than binding them as parameters. This is a classic first-order SQL injection in a PHP/MySQL stack.

Attack Vector

Exploitation occurs over the network against the HTTP interface of the vulnerable application. An attacker submits a crafted request to save_stud.php with SQL metacharacters in the fname, lname, or student_class fields. No user interaction or prior authentication is required. Refer to the TaintRadar GitHub PoC for a documented proof-of-concept payload.

Detection Methods for CVE-2025-67404

Indicators of Compromise

HTTP POST requests to save_stud.php containing SQL metacharacters such as ', --, UNION SELECT, SLEEP(, or information_schema in the fname, lname, or student_class parameters.
Unexpected INSERT, UPDATE, or SELECT errors in PHP or MySQL logs referencing the enrollment tables.
Anomalous outbound connections or file writes originating from the web server process after enrollment requests.

Detection Strategies

Deploy web application firewall (WAF) signatures for SQL injection patterns targeting the enrollment endpoint.
Enable MySQL general or audit logging and alert on statements containing unbalanced quotes or UNION-based patterns originating from the application user.
Perform static analysis of the PHP source to identify unparameterized query construction in save_stud.php and adjacent handlers.

Monitoring Recommendations

Monitor web access logs for high-frequency or malformed POST requests to save_stud.php.
Alert on database errors returned in HTTP responses, which indicate probing activity.
Baseline normal query patterns for the enrollment application and flag deviations such as long-running or high-row-count queries.

How to Mitigate CVE-2025-67404

Immediate Actions Required

Restrict network access to the CASAP Automated Enrollment System to trusted networks or VPN only until a fix is applied.
Place the application behind a WAF configured to block SQL injection payloads targeting save_stud.php.
Audit the database user assigned to the application and revoke privileges beyond those strictly required (no FILE, DROP, or administrative rights).
Review database and web logs for prior exploitation attempts against fname, lname, and student_class.

Patch Information

No official vendor patch has been published for CVE-2025-67404 at the time of the NVD entry. Administrators should modify save_stud.php to use parameterized queries via mysqli prepared statements or PDO with bound parameters. All user-supplied input must be treated as untrusted and validated against strict allowlists where feasible.

Workarounds

Rewrite affected queries to use prepared statements with bound parameters instead of string concatenation.
Apply server-side input validation that rejects SQL metacharacters in name and class fields.
Disable the vulnerable endpoint if the enrollment workflow is not actively required.

bash

# Example WAF rule (ModSecurity) to block SQLi patterns on save_stud.php
SecRule REQUEST_URI "@endsWith /save_stud.php" \
    "chain,phase:2,deny,status:403,id:1067404,msg:'Possible SQLi in CASAP save_stud.php'"
    SecRule ARGS:fname|ARGS:lname|ARGS:student_class \
        "@rx (?i)(\bunion\b.*\bselect\b|--|\bor\b\s+1=1|sleep\(|information_schema)"