CVE-2025-67408: CASAP Enrollment System SQLi Vulnerability

CVE-2025-67408 Overview

CVE-2025-67408 is a SQL Injection vulnerability in Sourcecodester CASAP Automated Enrollment System 1.0. The flaw resides in /save_user.php and stems from unsanitized handling of the status parameter. An unauthenticated attacker on the network can inject arbitrary SQL statements through this parameter. Successful exploitation allows attackers to read, modify, or delete records in the underlying database. The weakness is categorized under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated network attackers can manipulate database queries through the status parameter in /save_user.php, compromising confidentiality, integrity, and availability of enrollment data.

Affected Products

Sourcecodester CASAP Automated Enrollment System 1.0
/save_user.php endpoint
Deployments exposing the status parameter to untrusted input

Discovery Timeline

2026-07-29 - CVE-2025-67408 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-67408

Vulnerability Analysis

The CASAP Automated Enrollment System handles user record updates through the /save_user.php script. This script accepts a status parameter that is concatenated directly into a SQL statement. Because the application does not use parameterized queries or input validation, attackers can break out of the intended query context. Injected payloads execute against the backing MySQL database with the privileges of the web application user. The exploit path requires no authentication and no user interaction, which broadens the attacker population significantly.

Root Cause

The root cause is improper neutralization of user-supplied input before inclusion in a SQL statement [CWE-89]. The status parameter flows from the HTTP request into a dynamically constructed query without prepared statements or type enforcement. This design pattern exposes any SQL clause that references the parameter to injection.

Attack Vector

Exploitation occurs remotely over the network. An attacker submits a crafted HTTP request to /save_user.php with a malicious status value. Payloads can include UNION-based extraction, boolean-based inference, or time-based blind techniques. The attacker requires no privileges and no session context. Public exploit analysis is available in the TaintRadar SQL Injection Exploit Analysis.

No verified proof-of-concept code is reproduced here. Refer to the linked technical reference for parameter-level exploitation details and payload structure.

Detection Methods for CVE-2025-67408

Indicators of Compromise

HTTP POST or GET requests to /save_user.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or OR 1=1 in the status parameter.
Web server access logs showing unusually long or URL-encoded status values.
Database error messages referencing syntax errors originating from save_user.php.
Unexpected new administrative accounts or modified enrollment records without corresponding application activity.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL syntax tokens in the status parameter of /save_user.php.
Enable MySQL general query logging and correlate injected patterns to originating IP addresses.
Hunt for anomalous outbound data flows from the web server following requests to save_user.php.
Baseline expected values for status and alert on deviations.

Monitoring Recommendations

Ingest web server, WAF, and database logs into a centralized analytics platform for correlation.
Alert on repeated 500-series responses from /save_user.php, which indicate probing.
Monitor information_schema and mysql schema access patterns from the application account.

How to Mitigate CVE-2025-67408

Immediate Actions Required

Restrict network access to CASAP Automated Enrollment System instances until remediation is applied.
Deploy WAF signatures that block SQL metacharacters in the status parameter of /save_user.php.
Audit database accounts used by the application and revoke privileges beyond those strictly required.
Review database contents for unauthorized modifications or added user accounts.

Patch Information

No vendor patch is listed in the NVD entry at time of publication. Users of CASAP Automated Enrollment System 1.0 should monitor the Sourcecodester project page for updates and consider replacing the affected code path with parameterized queries. Refer to the TaintRadar analysis for the vulnerable code location.

Workarounds

Rewrite the affected query in /save_user.php to use PDO or MySQLi prepared statements with bound parameters.
Add server-side allowlist validation constraining status to a fixed enumerated set of values.
Place the application behind an authenticated reverse proxy to reduce exposure to unauthenticated attackers.
Remove or disable /save_user.php if the enrollment feature is not required.

bash

# Example WAF rule (ModSecurity) blocking SQL metacharacters in the status parameter
SecRule ARGS:status "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|or\s+1=1|--|;|')" \
    "id:1067408,phase:2,deny,status:403,\
    msg:'CVE-2025-67408 - SQLi attempt in save_user.php status parameter',\
    tag:'CWE-89'"