CVE-2025-11052 is a high severity (CVSS 7.3) SQL injection flaw in kidaze CourseSelectionSystem as listed in the record (1.0/5.php). The csslc parameter of COUNT3s5.php reaches a database query unsafely. The record lists no fixed release, so take the app off the public internet, fix the query with prepared statements, or retire the software.
What's affected
The record names kidaze CourseSelectionSystem as listed in the record (1.0/5.php). The affected code is /Profilers/PriProfile/COUNT3s5.php, where the csslc input is handled unsafely. NVD scores it 7.3 (HIGH) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which means network reachable, low complexity, no privileges and no user interaction.
The project ships as rolling releases, and the record names the product loosely, so treat any build you run as affected until the maintainer says otherwise.
Weakness classes: CWE-74, CWE-89. The record says a public write-up exists, which is why this one is worth acting on even though the software is small.
How to check if you're exposed
First find out whether you run this software at all. Search your servers and repositories for the file, then look at how it builds its query.
find / -type f -name 'COUNT3s5.php' 2>/dev/null
grep -rn "csslc" --include=*.php . | head
If the input goes into a query string by concatenation, the code is exposed. Then check your web server access log for requests to COUNT3s5.php from addresses you do not recognise, and for unusual characters in the csslc value. Log paths vary by server, so use the one your stack writes to.
You can also run the free in-browser dependency scan at gold.safeguard.sh/scan on any manifest you have. Note that this kind of finding lives in application code, not in a package, so a manual look matters here.
What to do now
- Decide whether you still need this software. Small PHP projects like this often have no active maintainer, so check whether this one does.
- If you keep it, take it off the public internet. Put it behind a VPN or an IP allow list.
- Fix the query. Replace string concatenation with prepared statements, as in the sample below.
- Run the database account with the least rights it needs, so that a bug cannot read or change more than it should.
- Watch the vendor page and the NVD record for a patched release, and read the changelog before you upgrade.
- Review logs for the past weeks for odd requests to
COUNT3s5.php.
$stmt = $pdo->prepare('SELECT * FROM items WHERE id = :id');
$stmt->execute([':id' => $_GET['id']]);
$rows = $stmt->fetchAll();
Why it matters
This is a classic injection bug. The code takes a request value and places it straight into a database command, so the database cannot tell data from instructions. CWE-74 is the general injection class, and CWE-89 is the SQL form of it.
The fix is not exotic. Prepared statements with bound parameters keep input and command apart, and they have been standard practice for years. The harder part is that code like this often has the same mistake in many files, so one fixed page rarely means a safe app.
Quick check
Is a fixed version of CourseSelectionSystem available?
The NVD record and its references do not name one. Check the vendor page, and treat any new download as unreviewed until you read the code.
Does a web application firewall fix this?
It can reduce the noise, but it does not repair the query. Use it as a stopgap and still fix the code with prepared statements.
Sources
- NVD record for CVE-2025-11052
- Reference listed in the record
- Reference listed in the record
- Safeguard Gold page for CVE-2025-11052
Last reviewed: 19 October 2026.
