PT-2025-41688
CVE-2025-11601
·
Published
2025-10-11
·
Updated
2025-10-20
Description by
CVSS 3.1
9.8
CriticalMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
SourceCodester Online Student Result System version 1.0
Description
A SQL injection issue exists in the SourceCodester Online Student Result System 1.0. The flaw is located in the
/login.php script, where manipulating the Username parameter can allow an attacker to execute arbitrary SQL commands on the database server remotely. The exploit is publicly available.Recommendations
Apply a fix to sanitize the
Username parameter in the /login.php script to prevent SQL injection.
As a temporary workaround, restrict access to the /login.php script.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾