CVE-2025-67404: Critical SQL Injection in CASAP Enrollment System save_stud.php

Executive Summary

CVE-2025-67404 is a critical SQL injection vulnerability (CVSS 9.8) affecting Sourcecodester CASAP Automated Enrollment System version 1.0. The flaw exists in the student registration endpoint save_stud.php, where the parameters fname, lname, and student_class are directly interpolated into SQL queries without sanitization. An unauthenticated remote attacker can exploit any of these three parameters to read, modify, or destroy the underlying database — and potentially achieve OS-level code execution if the database user holds elevated privileges.

Affected Software

CASAP (Computerized Automated Student Academic Performance) is an open-source PHP enrollment management system commonly used by schools in Southeast Asia. It is distributed freely through Sourcecodester.com.

Vulnerability Details

Root Cause

The student registration endpoint save_stud.php accepts student demographic data through HTTP POST and constructs SQL INSERT statements using direct string concatenation. Three parameters — fname (first name), lname (last name), and student_class — are not sanitized before being incorporated into the query, each providing an independent injection vector.

Vulnerable parameters: fname, lname, student_class
Affected endpoint:     save_stud.php
Injection type:        POST-based SQL Injection (three vectors)
Database:              MySQL

Multiple Injection Vectors

Unlike CVE-2025-67403 which exposes a single parameter, CVE-2025-67404 provides three independent injection points within a single endpoint. This increases the likelihood of exploitation success, as an attacker can choose whichever parameter is least filtered by any intermediate layer (e.g., WAF character limits).

Attack Scenario

1. Attacker locates internet-exposed CASAP instance
2. Sends HTTP POST to save_stud.php with SQL payload in fname, lname, or student_class
3. Injected SQL executes with the web application's database privileges
4. Attacker extracts full student database: names, addresses, academic records
5. May pivot to credential theft, record modification, or RCE via FILE privilege abuse

Why Student Registration is a High-Risk Endpoint

The student registration form is typically the most publicly accessible endpoint in an enrollment system — it is designed to be reachable by prospective students without authentication. This means:

• No authentication barrier to reach the vulnerable code path
• High volume of legitimate traffic makes anomaly detection harder
• The form's open nature is likely to be internet-facing during enrollment periods

CVSS Vector Breakdown

CVSS v3.1 Base Score: 9.8 (Critical)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Data Exposure Risk

CASAP enrollment systems hold personally identifiable information (PII) for enrolled students. A successful exploitation could expose:

Schools operating under FERPA (US), PIPEDA (Canada), PDPA (Philippines), or similar student data protection frameworks may face regulatory consequences from a breach.

Remediation

Immediate Mitigation

1. Restrict network access — Remove CASAP from public internet; require VPN for access
2. Deploy a WAF — Apply SQL injection filtering rules as an interim control
3. Monitor database logs — Review for anomalous SELECT, UNION, or DROP statements
4. Audit existing records — Check for signs of data tampering or unauthorized student entries
5. Change credentials — Rotate all database passwords and application admin accounts

Developer Fix

Replace string-concatenated queries in save_stud.php with parameterized statements:

// VULNERABLE pattern (do not use):
$sql = "INSERT INTO students (fname, lname, student_class)
        VALUES ('" . $_POST['fname'] . "',
                '" . $_POST['lname'] . "',
                '" . $_POST['student_class'] . "')";
 
// SECURE — PDO prepared statement:
$stmt = $pdo->prepare(
    "INSERT INTO students (fname, lname, student_class) VALUES (:fname, :lname, :student_class)"
);
$stmt->execute([
    ':fname'         => $_POST['fname'],
    ':lname'         => $_POST['lname'],
    ':student_class' => $_POST['student_class'],
]);

Additionally, implement input validation (length limits, character allowlists for names) as a defense-in-depth measure.

Relation to CVE-2025-67403

CVE-2025-67404 was disclosed alongside CVE-2025-67403 (SQL injection in update_class.php), indicating that the CASAP codebase has systemic SQL injection issues across multiple endpoints. Organizations running CASAP 1.0 should assume the vulnerability is not limited to these two files and conduct a full code audit of all SQL-constructing endpoints.

Detection

Key Takeaways

1. CVSS 9.8 Critical — Three injectable parameters in the public-facing student registration form
2. No authentication required — Reachable by anyone, including automated scanners
3. Systemic issue — Disclosed alongside CVE-2025-67403; assume CASAP has additional vulnerable endpoints
4. PII at risk — Student records, academic data, and administrative credentials all exposed
5. Immediate isolation required — Remove from internet exposure until code is patched

References

• NVD — CVE-2025-67404

Related Reading

• CVE-2025-67403: CASAP Class Update SQL Injection