CVE-2025-14643CWE-74CWE-89sql-injection

CVE-2025-14643

High · published December 14, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
37.2
In the wild
Unconfirmed
What it is

⚠️ A sneaky SQL injection lurks in the Simple Attendance Record System! An attacker can exploit this by manipulating a single argument in the /check.php file. 🐱‍👤 Think of this as a student sneaking into the school office and changing their grades on the attendance sheet without anyone noticing. If the school doesn't check the records thoroughly, anyone could change their status! This means that an attacker could potentially gain unauthorized access to sensitive data, modify records, or even execute commands on the database. While this isn’t a catastrophic breach, the implications for data integrity could be significant, leading to a loss of trust in the system.

Put simply

Think of this as a student sneaking into the school office and changing their grades on the attendance sheet without anyone noticing. If the school doesn't check the records thoroughly, anyone could change their status! In this vulnerability, the argument 'student' in the /check.php file is vulnerable to SQL injection, allowing an attacker to execute arbitrary SQL queries against the database by manipulating input data.

What to do

This means that an attacker could potentially gain unauthorized access to sensitive data, modify records, or even execute commands on the database. While this isn’t a catastrophic breach, the implications for data integrity could be significant, leading to a loss of trust in the system. To remediate this vulnerability, you should validate and sanitize all user inputs in the affected file. Implementing prepared statements or parameterized queries can also help mitigate the risk. Make sure to patch this issue as soon as possible! You've got this! With a few adjustments, you'll keep your system safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00441 · 37.2th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-12-14T09:15Z
Affected products (1)
ProductVersionsFixed in
fabian/simple_attendance_record_systemall versions—
References (5)
EPSS history
Timeline
  • 14 DEC 03:02Z
    code-projects Simple Attendance Record System check.php sql injection
    cvelistv5