CVE-2025-67407 in Enrollment System
Summary
by MITRE • 07/30/2026
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_student.php via parameters fname and student_class.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
The Sourcecodester CASAP Automated Enrollment System version 1.0 presents a critical security vulnerability through SQL injection flaws in the update_student.php script. This vulnerability manifests when attackers manipulate the fname and student_class parameters, allowing malicious input to be directly incorporated into database queries without proper sanitization or parameterization. The flaw resides in the application's failure to implement adequate input validation and output encoding mechanisms, creating an attack surface where database commands can be injected through user-controllable parameters. This vulnerability directly maps to CWE-89 which categorizes SQL injection as a serious weakness enabling attackers to execute unauthorized database operations, manipulate data, or potentially escalate privileges within the system.
The operational impact of this vulnerability extends beyond simple data corruption or theft, as it provides attackers with the capability to perform full database enumeration, extract sensitive user information including credentials, modify enrollment records, and potentially gain persistent access to the system. Attackers can exploit these parameters to construct malicious SQL payloads that bypass authentication mechanisms, retrieve confidential student data, or even execute administrative commands through the database interface. The vulnerability affects the core enrollment functionality of the system, compromising the integrity and confidentiality of educational records stored within the database.
Security professionals should consider this vulnerability in the context of ATT&CK technique T1213 which describes data exploitation through database management systems, and T1078 which covers valid accounts usage for persistence. The attack surface is particularly concerning as it targets an enrollment system where student information is paramount, making the potential impact on privacy and academic integrity significant. Organizations using this software face risks of compliance violations under regulations such as FERPA in educational contexts, as unauthorized access to student records constitutes a serious breach of data protection standards.
Mitigation strategies should include immediate implementation of parameterized queries or prepared statements for all database interactions, comprehensive input validation with whitelisting approaches, and regular security code reviews focusing on SQL injection vulnerabilities. The system requires proper sanitization of user inputs through escaping mechanisms and the application of least privilege principles for database connections. Additionally, implementing web application firewalls and intrusion detection systems can provide additional layers of protection while the core code is being patched. Regular security assessments and penetration testing should be conducted to identify similar vulnerabilities in other components of the system architecture.