External risk intelligence

Sourcecodester CASAP Automated Enrollment System SQL Injection in update_class.php

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-67403

This is a web application component (PHP script) typically deployed as part of an enrollment system. Such systems are commonly configured as web-based applications intended for user access over a network, making them likely to be exposed as web services.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the Sourcecodester CASAP Automated Enrollment System could allow unauthorized access and modification of sensitive data. This SQL injection flaw, present in the `update_class.php` file, does not require authentication and is accessible over the network, posing a significant risk if the system is deployed and exposed. The main concern at this stage is confirming relevance and exposure.

System allows unauthorized data access and changes.
Critical flaw in enrollment system needs attention.
Confirm relevance and any potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted input to the `update_class.php` script. If an attacker can reach this script, they may be able to manipulate the `class_name` parameter to inject malicious SQL code. This could allow them to read, modify, or delete data within the system's database.

No authentication required.
Vulnerable parameter in `update_class.php`.
Database compromise.

Live Threat

Current exploitation, exposure, and threat context

The vulnerability in the update_class.php script of the Sourcecodester CASAP Automated Enrollment System could allow an unauthenticated attacker to inject malicious SQL commands. This could occur when the `class_name` parameter is manipulated.

System data and integrity.
SQL injection via `class_name` parameter.
Unauthorized data modification or access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The application owner is responsible for addressing the SQL injection vulnerability in the Sourcecodester CASAP Automated Enrollment System. The first step is to identify all instances of this system, confirm its network reachability and business criticality, and then ascertain the accountable owner before planning remediation.

Application owners should manage this issue.
Verify system network exposure and business impact.
Plan remediation or mitigation strategy.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Sourcecodester CASAP Automated Enrollment System?

This software is a web-based application designed to manage student enrollment processes. It uses PHP scripts to handle data tasks, such as updating class information. Organizations deploy it as a service to process and store school records, relying on a database to maintain the integrity of student and course information.

What does CVE-2025-67403 mean by SQL injection?

This vulnerability belongs to the CWE-89 weakness class, which happens when software fails to properly sanitize user input before using it in a database query. Because of this flaw in CVE-2025-67403, an attacker can insert their own SQL commands into the system. This allows them to trick the database into performing unauthorized actions, such as revealing private records or modifying stored data.

How does an attacker trigger this vulnerability?

An attacker exploits this by sending a specially crafted request to the update_class.php script. The attack specifically targets the class_name parameter. Simply browsing the website or using the system for normal enrollment tasks will not trigger this bug; it requires the deliberate submission of malicious SQL code through that specific input field.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a web application component, which is typically deployed for network access. Because the script is designed for web-based enrollment, it is likely accessible over the network. If your instance is reachable via the internet, it faces a higher probability of being targeted compared to a system restricted to a private, internal-only network.

What should I do if I run this software?

Your first priority is to locate all deployments of the CASAP Automated Enrollment System in your environment. Confirm whether these systems are business-critical and check their network connectivity to determine if they are exposed. Identify the person responsible for the application to coordinate a review of the code or plan for necessary security updates to address the underlying input handling issue.

References

github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automa…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.