CVE-2025-67403: Critical SQL Injection in CASAP Enrollment System update_class.php

Executive Summary

CVE-2025-67403 is a critical SQL injection vulnerability (CVSS 9.8) affecting Sourcecodester CASAP Automated Enrollment System version 1.0. The flaw resides in the update_class.php endpoint, where the class_name POST parameter is passed directly to a SQL query without sanitization. An unauthenticated remote attacker can exploit this to extract, modify, or delete database contents, and potentially achieve server-level code execution depending on the database configuration.

Affected Software

CASAP is a PHP-based open-source school enrollment management system distributed through Sourcecodester.com. It is widely used by educational institutions in the Philippines and Southeast Asia as a low-cost enrollment management solution.

Vulnerability Details

Root Cause

The vulnerable endpoint update_class.php accepts a class_name parameter via HTTP POST and incorporates it directly into a SQL query without parameterized queries or proper input sanitization. This classic unsanitized user input pattern allows attackers to inject arbitrary SQL code.

Vulnerable parameter: class_name
Affected endpoint:    update_class.php
Injection type:       POST-based SQL Injection
Database:             MySQL (typical Sourcecodester stack)

Attack Scenario

1. Attacker identifies a CASAP enrollment system exposed to the internet
2. Sends crafted HTTP POST request to update_class.php
3. Injects SQL payload via class_name parameter
4. Extracts sensitive data (student records, credentials, staff data)
5. Potentially escalates to OS-level access via MySQL FILE/EXEC privileges

Potential Impact

A successful exploitation of CVE-2025-67403 can result in:

• Full database extraction — all student enrollment records, grades, personal information
• Authentication bypass — extraction or modification of administrator credentials
• Data tampering — modification of academic records, enrollment status, or grades
• Database destruction — DROP TABLE or DELETE operations
• Remote code execution — via MySQL INTO OUTFILE or LOAD_FILE if file privileges are enabled

CVSS Vector Breakdown

CVSS v3.1 Base Score: 9.8 (Critical)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Remediation

Immediate Actions

Since no vendor patch has been published at time of disclosure, organizations running CASAP Automated Enrollment System 1.0 should take the following steps immediately:

1. Remove internet exposure — Place the application behind a VPN or firewall; do not expose to the public internet
2. Apply input validation — Add parameterized queries or prepared statements to update_class.php
3. Deploy a WAF — A web application firewall with SQL injection rules can block exploitation attempts
4. Audit database access logs — Review for signs of unauthorized data access or exfiltration
5. Rotate credentials — Change all database and application passwords in case of prior compromise

Developer Fix

The root fix requires replacing direct SQL string concatenation with PDO prepared statements or MySQLi parameterized queries:

// VULNERABLE (do not use):
$sql = "UPDATE class SET class_name='" . $_POST['class_name'] . "' WHERE id=" . $_POST['id'];
 
// SECURE — use prepared statements:
$stmt = $pdo->prepare("UPDATE class SET class_name=:class_name WHERE id=:id");
$stmt->execute([':class_name' => $_POST['class_name'], ':id' => $_POST['id']]);

Detection

Organizations with logging in place can look for the following indicators of exploitation attempts:

Background: Sourcecodester Vulnerabilities

Sourcecodester is a PHP/MySQL project repository commonly used for educational and small-business systems. Vulnerabilities in Sourcecodester projects are frequently disclosed, as the codebase often lacks security review and relies on outdated patterns like direct SQL string construction. Security researchers regularly scan for and report these flaws through NVD/CVE channels.

CVE-2025-67403 follows a pattern of similar critical SQL injection disclosures in Sourcecodester systems. Organizations using any Sourcecodester-distributed software should audit their deployments for similar unsanitized input patterns.

Key Takeaways

1. CVSS 9.8 Critical — Pre-authentication SQL injection with full database access
2. No patch available — Mitigation requires manual code changes or network isolation
3. Remove from public internet — CASAP enrollment systems should not be internet-facing without hardening
4. Audit for compromise — Assume exploitation if the system has been publicly accessible
5. Apply parameterized queries — The only lasting fix is code-level remediation

References

• NVD — CVE-2025-67403

Related Reading

• CVE-2025-67404: CASAP Student Registration SQL Injection