CVE-2025-14622CWE-74CWE-89sql-injection

CVE-2025-14622

High · published December 13, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
34.8
In the wild
Unconfirmed
What it is

⚠️ A simple tweak to the 'firstname' parameter could lead to a sneaky SQL injection! This vulnerability in Student File Management System 1.0 is like a restaurant that never checks its customer orders before sending them back to the kitchen. 🍽️ Imagine a dining experience where a waiter blindly takes orders without verifying them with the kitchen. In this case, a crafty attacker can manipulate the 'firstname' input, resulting in unauthorized access to the database, much like a mix-up in the kitchen could lead to serving the wrong dish to the wrong table. An attacker could exploit this vulnerability to execute arbitrary database queries, potentially compromising sensitive user information. The consequences could range from unauthorized data access to more severe manipulations, all executed remotely and without a login. This could be absolutely devastating for any organization relying on this system!

Put simply

Imagine a dining experience where a waiter blindly takes orders without verifying them with the kitchen. In this case, a crafty attacker can manipulate the 'firstname' input, resulting in unauthorized access to the database, much like a mix-up in the kitchen could lead to serving the wrong dish to the wrong table. This vulnerability allows SQL injection through the 'firstname' parameter in /admin/save_user.php, enabling attackers to manipulate database queries and potentially extract or modify data.

What to do

An attacker could exploit this vulnerability to execute arbitrary database queries, potentially compromising sensitive user information. The consequences could range from unauthorized data access to more severe manipulations, all executed remotely and without a login. This could be absolutely devastating for any organization relying on this system! To protect against this vulnerability, update the Student File Management System to the latest version, use prepared statements for database queries, and conduct a thorough audit of all inputs handling. It's crucial to validate and sanitize user inputs properly to prevent such exploits. You've got this! With a few simple steps, you can patch this vulnerability and keep your system secure. 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00415 · 34.8th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-12-13T23:15Z
Affected products (1)
ProductVersionsFixed in
fabian/student_file_management_systemall versions—
References (6)
EPSS history
Timeline
  • 13 DEC 17:32Z
    code-projects Student File Management System save_user.php sql injection
    cvelistv5