External risk intelligence

Automated Enrollment System SQL Injection Vulnerability in save_stud.php

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-67404

The vulnerability exists in an automated enrollment system, which is a web-based application typically deployed to be accessible to students or applicants over the internet for registration purposes, placing this functionality at an internet-facing endpoint.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in the Sourcecodester CASAP Automated Enrollment System. The issue, a SQL injection flaw, could allow unauthorized access to or manipulation of the system's data if exploited. The primary concern is confirming whether this specific system is in use and exposed.

Flaw allows unauthorized data access or changes.
Critical system vulnerability needs awareness.
Confirm relevance and exposure of the system.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted data over the network to the `save_stud.php` script. This script, which is part of the Sourcecodester CASAP Automated Enrollment System, does not properly sanitize user input in the `fname`, `lname`, and `student_class` parameters. If exploited, this could allow an attacker to manipulate the system's database.

No authentication required.
Exploited via web parameters.
Leads to database manipulation.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to manipulate the automated enrollment system by injecting malicious SQL code into student registration data. When supported, this could lead to unauthorized access or modification of student records stored in the system's database.

Student registration data.
Via unsanitized input parameters.
Unauthorized database access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in Sourcecodester CASAP Automated Enrollment System requires action from application owners and potentially infrastructure teams to identify and secure the affected system. The first practical step is to locate all instances of this system, determine their accessibility and criticality, and assign ownership for remediation planning.

Application owners should own the issue.
Verify system reachability and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Sourcecodester CASAP Automated Enrollment System?

The CASAP Automated Enrollment System is a software application designed to manage student registration workflows. It provides a digital interface for processing enrollments and storing student information in a database. Organizations typically use such systems to streamline administrative tasks by allowing users to input registration details directly into the platform.

What does SQL injection mean for CVE-2025-67404?

This vulnerability is classified as CWE-89, which occurs when a program fails to filter user input before including it in a database query. In this case, the system treats data provided in specific fields as database commands rather than simple text. An attacker can use this weakness to send malicious SQL instructions, potentially allowing them to view, modify, or delete sensitive records stored within the enrollment system's database.

How can an attacker trigger this vulnerability?

The vulnerability is triggered by sending a request to the save_stud.php script with malicious content embedded in the fname, lname, or student_class parameters. Because the application does not validate this input, the code executes the injected commands. Notably, this flaw does not require the attacker to have an existing account or password, as the interface accepts the input directly from the network.

How relevant is this CVE to my systems?

According to Halo Surface Signal, this software is often deployed as an internet-facing enrollment portal to facilitate student registration. If your instance is accessible from the internet, it is directly exposed to external requests. You should prioritize assessing whether your deployment is reachable by unauthorized parties, as these systems are often intentionally placed on public-facing networks.

What should I do if I use this enrollment system?

Your first step is to perform an inventory to locate all instances of this software within your environment. Once identified, evaluate the system's current exposure and business criticality. Since this involves a flaw in how the application handles data, involve your technical teams to verify the reachability of the affected script and coordinate a plan to mitigate the risk of unauthorized database interaction.

References

github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automa…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.