CVE-2025-15195CWE-74CWE-89sql-injection

CVE-2025-15195

High · published December 29, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
35.9
In the wild
Unconfirmed
What it is

⚠️ A sneaky SQL injection is lurking in the shadows of your Assessment Management system! An unguarded argument in /admin/add-module.php might just be the ticket for an opportunistic attacker. 🔍 Think of your application as a restaurant kitchen. If the chefs let anyone sneak in and alter the recipe without anyone checking the order, disaster is just a few minutes away. This vulnerability lets attackers modify database queries like that: undetected and potentially harmful! An attacker could exploit this vulnerability to manipulate the underlying database, accessing sensitive information, altering records, or worse – completely compromising the system. It's like someone tampering with your restaurant's ingredients, leading to disastrous results and unhappy customers!

Put simply

Think of your application as a restaurant kitchen. If the chefs let anyone sneak in and alter the recipe without anyone checking the order, disaster is just a few minutes away. This vulnerability lets attackers modify database queries like that: undetected and potentially harmful! The vulnerability in Assessment Management 1.0 allows for SQL injection via an unprotected parameter called linked[] in the /admin/add-module.php file. This means that unexpected SQL queries could be run, giving attackers a backdoor into your database.

What to do

An attacker could exploit this vulnerability to manipulate the underlying database, accessing sensitive information, altering records, or worse – completely compromising the system. It's like someone tampering with your restaurant's ingredients, leading to disastrous results and unhappy customers! To safeguard your system, patch to the latest version immediately to close this loophole. Ensure that input validation is implemented for parameters like linked[], and consider using prepared statements or ORM tools to prevent injection attacks. 🛡️ You've got this! Take action now, and you'll have your app secured in no time! 💪😊

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00427 · 35.9th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-12-29T21:15Z
Affected products (1)
ProductVersionsFixed in
code-projects/assessment_managementall versions—
References (6)
EPSS history
Timeline
  • 29 DEC 16:02Z
    code-projects Assessment Management add-module.php sql injection
    cvelistv5