CVE-2025-11434

A critical SQL injection vulnerability has been identified in itsourcecode's Student Transcript Processing System 1.0. The flaw resides in the /login.php file, where the uname parameter is directly incorporated into SQL queries without proper sanitization or validation [1]. This root cause allows attackers to inject malicious SQL code through user input, bypassing intended authentication logic and directly interacting with the underlying database [1].

Attack

Vector The vulnerability is exploitable remotely without any authentication requirement. An attacker sends a specially crafted POST request to the login page, injecting SQL commands into the uname field. The provided public proof-of-concept (POC) demonstrates a boolean-based blind SQL injection technique using MySQL's RLIKE operator, allowing for iterative data extraction even without direct output [1]. No special network position or privileges are needed; the attack can be launched from any internet-connected host.

Impact

Successful exploitation grants an attacker unauthorized access to the database, enabling data theft, modification, deletion, and potentially full system control. This could lead to leakage of sensitive student transcripts, credential compromise, and service disruption [1]. The vendor's homepage lists the software as available for download, indicating potential widespread use in educational environments [2].

Mitigation

As of the CVE publication date, no official patch has been released. The vendor has been notified via the security report, and administrators are advised to implement input validation and parameterized queries as immediate workarounds. Given the public availability of exploit code, affected instances should be considered at high risk of active exploitation.