CVE-2025-14214
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability exists in an unknown part of the file /section_edit1.php in itsourcecode Student Information System 1.0. Manipulation of the ID argument leads to SQL injection. Remote exploitation is possible, and the exploit has been publicly disclosed and may be used.
Risk Assessment
An attacker could execute arbitrary SQL queries, potentially leading to disclosure, modification, or deletion of database data. This may result in a breach of confidentiality, integrity, and availability.
Recommendation
Immediately apply a patch or mitigation such as validating and parameterizing SQL queries in /section_edit1.php. If no patch is available, consider disabling or restricting access to the vulnerable file.
Other vulnerabilities in itsourcecode Student Information System
See all- CVE-2025-13581Medium
SQL injection vulnerability in /schedule_edit1.php of itsourcecode Student Information System 1.0. Manipulation of the schedule_id argument allows remote SQL injection. The exploit is publicly available.
- CVE-2025-10613Medium
A vulnerability has been found in itsourcecode Student Information System 1.0. The affected element is an unknown function of the file /leveledit1.php. Such manipulation of the argument level_id leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Original NVD description (English source)
A vulnerability has been found in itsourcecode Student Information System 1.0. This affects an unknown part of the file /section_edit1.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS