PT-2025-43946 · Unknown · Abdullah-Hasan-Sajjad Online-School

Daoyunxinshang · Published 2025-10-27 · Updated 2025-10-27 · CVE-2025-12277

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Abdullah-Hasan-Sajjad Online-School versions prior to f09dda77b4c29aa083ff57f4b1eb991b98b68883

Description A flaw exists in Abdullah-Hasan-Sajjad Online-School. The issue is related to the manipulation of the Email argument in the /studentLogin.php file, which can lead to SQL injection. This allows for remote attacks. The product uses a rolling release strategy for continuous delivery. The vendor was contacted regarding this issue but did not respond.

Recommendations Versions prior to f09dda77b4c29aa083ff57f4b1eb991b98b68883 should be updated. As a temporary workaround, consider restricting access to the /studentLogin.php file.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-12277

Affected Products

Abdullah-Hasan-Sajjad Online-School

References · 6

• 🔥 https://github.com/DaoYunXinShang/Reports/blob/main/sql%20injection.doc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12277 · Security Note
• https://t.me/CVEtracker/35838 · Telegram Post
• https://vuldb.com/?ctiid.329948 · Note
• https://vuldb.com/?submit.674173 · Note
• https://vuldb.com/?id.329948 · Note