CVE-2025-67404

Name of the Vulnerable Software and Affected Versions Sourcecodester CASAP Automated Enrollment System version 1.0

Description An issue exists in the 'save stud.php' endpoint where improper handling of the fname, lname, and student class parameters allows for SQL Injection. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations Update Sourcecodester CASAP Automated Enrollment System version 1.0 to a version that addresses this issue. As a temporary workaround, restrict access to the 'save stud.php' endpoint or validate the fname, lname, and student class parameters to prevent malicious input.