CVE Alert: CVE-2025-11601 – SourceCodester – Online Student Result System

Risk verdict: High risk of remote SQL injection via the login endpoint, with a publicly available exploit increasing the likelihood of rapid exploitation.

Why this matters: An attacker can bypass authentication or manipulate data in the user/login flow, potentially exposing student records or altering results. The combination of remote access, no user interaction, and volatile DB impact raises the likelihood of data leakage, integrity compromise, or downtime for the system.

Most likely attack path: Attacker targets the login.php Username parameter over the network, sending crafted input to trigger a classic SQLi. With no authentication required, the attacker can run arbitrary queries against the database, potentially exfiltrating or altering data and then moving laterally within the app’s backend if privileges allow.

Who is most exposed: Organisations running SourceCodester Online Student Result System v1.0, especially educational institutions or hosting providers deploying the vendor’s demo/legacy builds, are at elevated risk due to exposed login functionality and likely outdated code with limited input sanitisation.

Detection ideas:

• Unusual or malformed Username input patterns in web logs.
• SQL error messages or database errors appearing in application or server logs.
• Anomalous authentication attempts from unknown IPs targeting login.php.
• WAF alerts for SQLi-like payloads or query-like anomalies.
• Sudden spikes in data access or export activity from student records.

Mitigation and prioritisation:

• Apply vendor patch or upgrade to a fixed version; if unavailable, implement robust parameterised queries and prepared statements in login logic.
• Harden input validation on Username; implement least-privilege DB user for the application.
• Enable WAF rules specific to SQLi payloads and monitor for SQL error signatures.
• Disconnect or restrict public exposure of the login endpoint until fixed; implement compensating controls (logging, alerting) and routine credential monitoring.
• Plan a staged remediation with testing in a non-production environment; ensure change management sign-off.