PT-2025-51143 · Itsourcecode · Student Management System

Mountain Ghost · Published 2025-12-14 · Updated 2025-12-19 · CVE-2025-14644

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions itsourcecode Student Management System version 1.0

Description A flaw exists in itsourcecode Student Management System 1.0 that allows for SQL injection. The issue is located in the /update subject.php file, specifically through manipulation of the ID argument within an unknown function. This allows for remote execution of attacks. The exploit has been publicly disclosed.

Recommendations Apply updates to address the issue in the /update subject.php file. As a temporary workaround, restrict access to the ID parameter in the /update subject.php file.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-14644

Affected Products

Student Management System

References · 13

• 🔥 https://github.com/Bai-public/CVE/issues/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14644 · Security Note
• https://osv.dev/vulnerability/CVE-2025-14644 · Vendor Advisory
• https://vuldb.com/?ctiid.336377 · Note
• https://twitter.com/VulmonFeeds/status/2000064553799840084 · Twitter Post
• https://vuldb.com/?id.336377 · Note
• https://itsourcecode.com · Note
• https://t.me/cveNotify/145688 · Telegram Post
• https://vuldb.com/?submit.708739 · Note
• https://twitter.com/cracbot/status/2001970820613320928 · Twitter Post
• https://twitter.com/TheHackerWire/status/2000060309772668981 · Twitter Post
• https://twitter.com/CVEnew/status/2000246125752676734 · Twitter Post
• https://t.me/CVEtracker/39751 · Telegram Post