CVE-2025-15053CWE-74CWE-89sql-injection

CVE-2025-15053

High · published December 24, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
30.9
In the wild
Unconfirmed
What it is

⚠️ A crafty little oversight in the Student Information System could let attackers manipulate your database with a mere tweak of the search box! Think of it like a restaurant that serves food without checking the kitchen orders — the server mistakenly accepts a request that’s completely wrong, leading to chaos in the meals being delivered! An attacker could execute unauthorized SQL commands, potentially exposing sensitive student information or altering critical data. This could lead to data leaks or even a complete loss of integrity in your system. While it’s not being actively exploited yet, the vulnerability is a ticking time bomb!

Put simply

Think of it like a restaurant that serves food without checking the kitchen orders — the server mistakenly accepts a request that’s completely wrong, leading to chaos in the meals being delivered! The flaw allows for SQL injection via the 'searchbox' argument in the /searchresults.php file of the Student Information System, enabling attackers to manipulate database queries without proper validation.

What to do

An attacker could execute unauthorized SQL commands, potentially exposing sensitive student information or altering critical data. This could lead to data leaks or even a complete loss of integrity in your system. While it’s not being actively exploited yet, the vulnerability is a ticking time bomb! To mitigate this, update the Student Information System to the latest version as soon as a patch is available. Also, ensure that all user inputs, especially from search features, are properly sanitized to prevent SQL injection attacks. You've got this! Implement these fixes, and you'll keep your data safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00381 · 30.9th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-12-24T07:15Z
Affected products (1)
ProductVersionsFixed in
fabian/student_information_systemall versions—
References (5)
EPSS history
Timeline
  • 24 DEC 02:02Z
    code-projects Student Information System searchresults.php sql injection
    cvelistv5