CVE-2025-67407: CASAP Enrollment System SQLi Vulnerability

CVE-2025-67407 Overview

CVE-2025-67407 is a SQL Injection vulnerability [CWE-89] in Sourcecodester CASAP Automated Enrollment System 1.0. The flaw resides in update_student.php, where the fname and student_class parameters are passed to database queries without proper sanitization. Attackers can inject arbitrary SQL statements over the network without authentication. Successful exploitation compromises the confidentiality, integrity, and availability of the underlying database.

Critical Impact
Unauthenticated network attackers can manipulate SQL queries through update_student.php, enabling data theft, record tampering, and potential full database compromise.

Affected Products

Sourcecodester CASAP Automated Enrollment System 1.0
update_student.php endpoint (fname parameter)
update_student.php endpoint (student_class parameter)

Discovery Timeline

2026-07-29 - CVE-2025-67407 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-67407

Vulnerability Analysis

The vulnerability exists in the student update workflow of the CASAP Automated Enrollment System. The update_student.php script accepts user-controlled values through the fname and student_class request parameters. These values are concatenated directly into SQL statements without parameterization or input validation.

An attacker can supply crafted payloads that alter query logic. This enables extraction of arbitrary records, modification of stored data, and destructive operations against the database schema. The EPSS score is 0.143% with a 4.099 percentile, reflecting low observed exploitation activity to date.

Because the application handles student enrollment data, exploitation can expose personally identifiable information (PII). Attackers may also chain the flaw with authentication weaknesses to escalate their foothold.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. Input arriving through the fname and student_class POST parameters is embedded into query strings using string concatenation. The application does not use prepared statements or bound parameters.

Attack Vector

Exploitation is remote and requires no authentication or user interaction. An attacker sends a crafted HTTP request to update_student.php containing SQL metacharacters in the vulnerable parameters. The injected payload executes within the application's database context, returning data or altering records based on the query structure. See the TaintRadar SQLi Analysis for a detailed taint-propagation walkthrough.

Detection Methods for CVE-2025-67407

Indicators of Compromise

HTTP POST requests to update_student.php containing SQL metacharacters such as single quotes, UNION SELECT, --, OR 1=1, or SLEEP( in the fname or student_class parameters.
Web server access logs showing anomalously large or malformed request bodies targeting the enrollment endpoint.
Unexpected database errors or schema enumeration attempts (information_schema, sqlite_master) originating from the web application user.
Sudden mass modifications or deletions in student records without corresponding administrative activity.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect POST parameters submitted to update_student.php for SQL injection patterns.
Enable database query logging and alert on statements referencing update_student context with suspicious tautologies or stacked queries.
Correlate authentication logs with database write events to identify unauthenticated modifications.

Monitoring Recommendations

Monitor outbound connections from the web server to detect data exfiltration following suspected injection attempts.
Baseline normal request volume to update_student.php and alert on volume spikes or off-hours activity.
Retain HTTP request bodies and database audit logs for at least 90 days to support incident response.

How to Mitigate CVE-2025-67407

Immediate Actions Required

Restrict network access to the CASAP Automated Enrollment System through IP allowlisting or VPN until a code fix is deployed.
Audit update_student.php and refactor SQL calls to use parameterized queries with bound parameters.
Review database audit logs for signs of prior injection attempts against the fname and student_class parameters.
Rotate database credentials and application secrets if compromise is suspected.

Patch Information

No official vendor patch has been published for Sourcecodester CASAP Automated Enrollment System 1.0 at the time of NVD publication. Operators must apply source-level remediation, replacing string concatenation with prepared statements using PDO or MySQLi parameterized APIs, and enforcing server-side input validation.

Workarounds

Place the application behind a WAF configured with OWASP Core Rule Set SQL injection rules.
Enforce the principle of least privilege on the database account used by the application, removing DROP, ALTER, and FILE permissions.
Disable or remove the update_student.php endpoint if the update workflow is not required in production.
Add server-side allowlist validation for fname (alphabetic characters) and student_class (expected class identifiers) before query construction.

bash

# Example ModSecurity rule to block SQLi patterns targeting update_student.php
SecRule REQUEST_URI "@endsWith /update_student.php" \
    "id:1067407,phase:2,deny,status:403,log,\
     msg:'Potential SQLi against CASAP update_student.php',\
     chain"
  SecRule ARGS:fname|ARGS:student_class \
      "@detectSQLi" \
      "t:none,t:urlDecodeUni,t:lowercase"