CVE Alert: CVE-2025-11032 – kidaze – CourseSelectionSystem

Risk verdict

High risk: publicly released PoC enables remote SQL injection with no authentication, making exploitation feasible without user interaction.

Why this matters

An attacker could exfiltrate or tamper data, disrupt service, or pivot within the application’s data domain. The vulnerability targets a web-facing PHP endpoint, increasing exposure for educational institutions and organisations hosting student data or sensitive records.

Most likely attack path

Attacker can reach the vulnerable endpoint over the network (AV:N) with no user interaction (UI:N) and no credentials (PR:N). The attack relies on manipulating input (AC:L) to trigger SQL injection, potentially compromising confidentiality, integrity, and availability (C:L/I:L/A:L). Privilege scope remains unchanged, limiting lateral movement unless the attacker laterals through the database.

Who is most exposed

Applications with publicly reachable PHP endpoints and rolling-release deployments are at highest risk, especially those handling sensitive student or organisational data and lacking robust input validation.

Detection ideas

• Monitor for unusual or crafted values targeting the CPU parameter in requests to the vulnerable endpoint.
• Look for SQL error messages or database-level anomalies in application and DB logs.
• Flag spikes in failed/blocked requests to the endpoint from diverse IPs.
• Review web application firewall (WAF) alerts for injection-like payloads.
• Correlate with signs of data access or modification inconsistent with normal use.

Mitigation and prioritisation

• Apply the vendor fix or upgrade to a patched/validated release as soon as available.
• Enforce parameterised queries and strong input validation; use prepared statements.
• Tighten access to the endpoint: implement authentication, input whitelisting, or disable the endpoint if feasible.
• Deploy WAF rules to detect injection patterns and rate-limit suspicious traffic.
• Schedule urgent patching and testing in staging before production; document change-management steps. If KEV or EPSS indicators are available and ≥0.5, treat as priority 1.