CVE-2025-67407

Name of the Vulnerable Software and Affected Versions Sourcecodester CASAP Automated Enrollment System version 1.0

Description An issue exists in the 'update student.php' endpoint where improper handling of the fname and student class parameters allows for SQL Injection. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to or manipulation of the database.

Recommendations Update Sourcecodester CASAP Automated Enrollment System version 1.0 to a version that addresses this issue. As a temporary workaround, restrict access to the 'update student.php' endpoint or avoid using the fname and student class parameters until a fix is applied.