PT-2025-38320 · Kidaze · Courseselectionsystem

Qihao

·

CVE-2025-10665

·

Published

2025-09-18

·

Updated

2025-09-19

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions kidaze CourseSelectionSystem versions prior to 42cd892b40a18d50bd4ed1905fa89f939173a464
Description A vulnerability exists in kidaze CourseSelectionSystem. The manipulation of the argument csem in an unknown function of the file /Profilers/PProfile/COUNT3s3.php leads to SQL injection. Remote exploitation is possible.
Recommendations As a temporary workaround, consider restricting access to the file /Profilers/PProfile/COUNT3s3.php until a fix is available. Avoid using the parameter csem in the affected file until the issue is resolved.

Exploit

Fix

Special Elements Injection

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-74CWE-89

Related Identifiers

CVE-2025-10665

Affected Products

Courseselectionsystem