PT-2025-52411 · Unknown · Scholars Tracking System

Guanyingxin · Published 2025-12-19 · Updated 2025-12-24 · CVE-2025-14940

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Scholars Tracking System version 1.0

Description A SQL injection issue exists in Scholars Tracking System 1.0. The issue is located in the /admin/delete user.php file, specifically within an unknown function. Manipulation of the ID argument can trigger the SQL injection. This allows for remote exploitation. The exploit has been publicly disclosed.

Recommendations Apply updates to address the SQL injection issue in the /admin/delete user.php file. As a temporary workaround, restrict access to the /admin/delete user.php file. Sanitize the ID parameter before using it in SQL queries.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-14940

Affected Products

Scholars Tracking System

References · 13

• 🔥 https://github.com/gx922/CVE/issues/1 · Exploit
• https://osv.dev/vulnerability/CVE-2025-14940 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14940 · Security Note
• https://twitter.com/CVEnew/status/2002099192349733208 · Twitter Post
• https://vuldb.com/?ctiid.337520 · Note
• https://twitter.com/VulmonFeeds/status/2002046188011348451 · Twitter Post
• https://twitter.com/RedPacketSec/status/2001891182784164103 · Twitter Post
• https://vuldb.com/?submit.716120 · Note
• https://t.me/CVEtracker/40229 · Telegram Post
• https://twitter.com/cracbot/status/2003782758267846809 · Twitter Post
• https://t.me/cveNotify/146743 · Telegram Post
• https://vuldb.com/?id.337520 · Note
• https://code-projects.org · Note