CVE-2025-12873 is a medium severity SQL injection flaw (CVSS 4.7) in Campcodes School File Management 1.0. It affects the file /admin/update_user.php, through the user_id argument. The record lists no fixed version, so treat the application as unpatched until the vendor says otherwise.
What's affected
The CVE record names Campcodes School File Management 1.0 as the affected product. The weak spot is the file /admin/update_user.php, and the attacker-controlled value is the user_id argument. The record scores it 4.7 (medium) with this vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L.
Read the vector for what it says about exposure. The attack is network based and it needs an administrator-level account. That requirement lowers the score, but admin pages are common targets and admin credentials are often weak or reused.
There is no fixed version in the record. The product appears to be a standalone PHP project distributed as source code, not a package from a registry, so there is usually no upgrade path to wait for. The CVE description also states that an exploit has been published, which raises the odds that scanners will probe for it. Check the vendor site and the references below for any update, and assume none exists until you see one.
How to check if you're exposed
Start by finding out whether you run this code at all. Source-code projects like this tend to be copied into a web root, renamed and forgotten.
Search your web servers for the vulnerable file and for the project name:
find /var/www -type f -name "update_user.php" 2>/dev/null
grep -rIil "School File Management" /var/www 2>/dev/null | head
Then look at how the file builds its SQL. Any query that joins user_id or another request value into a string is a candidate:
grep -n "\$_POST\|\$_GET\|\$_REQUEST" admin/update_user.php
Finally, check your access logs for requests to the path that carry quote characters or SQL keywords in the parameters. Hits do not prove a breach, but a clean log is useful evidence too.
Dependency scanners will not see this kind of project by name, because it has no manifest. If the application sits in a repository next to other code, the free in-browser scan at gold.safeguard.sh/scan will still cover the libraries around it, and the Gold vulnerability page for CVE-2025-12873 tracks the record.
What to do now
- Find every deployment of School File Management 1.0 and decide whether it needs to be online. Many of these are demo or test installs that can simply be removed.
- If it must stay, take it off the public internet. Put it behind a VPN or an IP allowlist, and restrict the admin paths first.
- Fix the query. Replace string concatenation with a prepared statement, and bind
user_idas a parameter:
$stmt = $conn->prepare("SELECT * FROM table_name WHERE column_name = ?");
$stmt->bind_param("s", $value); // "s" for text, "i" for integers
$stmt->execute();
- Give the application's database account only the permissions it needs. It should not own the schema or read tables unrelated to this app.
- Review logs and database contents for unexpected rows, accounts or reads since the exploit became public.
- Watch the vendor page and the references below. If a fixed release appears, the advisory should state the version. Verify it before you rely on it.
Why it matters
SQL injection is a weakness where input is placed into a database command without being kept separate from the command itself. The record maps it to CWE-74 and CWE-89. The database cannot tell data from instructions, so a crafted value can change what the query does. The impact depends on the account the app uses, and the vector here rates confidentiality, integrity and availability as low each.
Low scores should not lead you to ignore it. Flaws like this often repeat across a codebase, because pages tend to be written the same way. One confirmed injection point in update_user is a good reason to review the rest of the application.
The record does not flag CVE-2025-12873 as a CISA Known Exploited Vulnerability, and it does not claim exploitation in the wild. The accurate statement is that the description says exploit details are public.
Quick check
Is there a patched version of School File Management 1.0?
The CVE record does not list one. Check the vendor site and the references below. Until a fix is confirmed, correct the query in your own copy and restrict access.
Does this need a login to exploit?
Per the vector, the attack needs an administrator-level account. It is still started over the network, so exposure of the pages involved matters.
Sources
References listed in the CVE record:
- https://github.com/YYYGdd/CVE/issues/1
- https://vuldb.com/?ctiid.331510
- https://vuldb.com/?id.331510
- https://vuldb.com/?submit.680854
- https://www.campcodes.com/
- Gold entry for CVE-2025-12873
Last reviewed: 19 October 2026.
