CVE-2025-15078CWE-74CWE-89sql-injection

CVE-2025-15078

High · published December 25, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
31.3
In the wild
Unconfirmed
What it is

⚠️ A sneaky little SQL injection is hiding in the itsourcecode Student Management System 1.0! Just manipulating the right argument can lead to serious trouble. 😱 Think of it like a waiter taking an order without checking the menu first. If they misinterpret your request, they could serve something completely off the wall — in this case, giving attackers access to sensitive data without a proper check! If an attacker launches this exploit, they could potentially manipulate the database in unexpected ways — viewing sensitive data, modifying records, or even deleting important information. For a student management system, this could mean exposing personal information and disrupting educational activities. Yikes!

Put simply

Think of it like a waiter taking an order without checking the menu first. If they misinterpret your request, they could serve something completely off the wall — in this case, giving attackers access to sensitive data without a proper check! This vulnerability arises from an SQL injection flaw in the /list_report.php file, triggered by improper handling of the argument 'sy'. An attacker can exploit this flaw remotely, allowing for unauthorized database access.

What to do

If an attacker launches this exploit, they could potentially manipulate the database in unexpected ways — viewing sensitive data, modifying records, or even deleting important information. For a student management system, this could mean exposing personal information and disrupting educational activities. Yikes! To mitigate this risk, update your itsourcecode Student Management System to the latest version as soon as it's available. Additionally, validate all input parameters to ensure they're safe and utilize prepared statements for database interactions to prevent SQL injection. Don't leave your data unguarded! You've got this! With these steps, you can lock down your system and keep those pesky attackers at bay. 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00384 · 31.3th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-12-25T10:16Z
Affected products (1)
ProductVersionsFixed in
angeljudesuarez/student_management_systemall versions—
References (5)
EPSS history
Timeline
  • 25 DEC 05:02Z
    itsourcecode Student Management System list_report.php sql injection
    cvelistv5