CVE-2025-60307
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A SQL injection vulnerability has been discovered in code-projects Computer Laboratory System 1.0. Entering a universal password in the Password field on the login page can bypass authentication.
Risk Assessment
An attacker can gain unauthorized access to the system, potentially leading to data theft, modification, or deletion, as well as full application compromise.
Recommendation
Immediately update the system to the latest version or apply a patch that fixes the SQL injection vulnerability. Additionally, implement input validation and use prepared statements.
Other vulnerabilities in Computer Laboratory System
See all- CVE-2025-14642Medium
In the Computer Laboratory System 1.0 from code-projects, a vulnerability was found in the file technical_staff_pic.php, where manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2025-14641Medium
In the Computer Laboratory System 1.0 from code-projects, a vulnerability was found in the file admin/admin_pic.php, where manipulation of the argument image causes unrestricted upload. The attack may be initiated remotely, and the exploit has been published.
- CVE-2025-56295High
A file upload vulnerability exists in Computer Laboratory System 1.0. Staff can upload PHP backdoor files when modifying personal avatar information and use web shell tools to gain server access.
Original NVD description (English source)
code-projects Computer Laboratory System 1.0 has a SQL injection vulnerability, where entering a universal password in the Password field on the login page can bypass login attempts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS