CVE-2025-3119 is a Medium severity (CVSS 6.3) SQL injection in SourceCodester Online Tutor Portal 1.0, in the file /tutor/courses/manage_course.php through the ID parameter. The record lists no fixed version. Treat the application as unpatched, restrict who can reach it, and replace the unsafe query with a parameterized one.
What's affected
The record covers SourceCodester Online Tutor Portal version 1.0. The affected file is /tutor/courses/manage_course.php, and the manipulation of the ID parameter leads to SQL injection. The description says the attack can be started remotely, and that the exploit has been disclosed to the public and may be used. It does not say the flaw is exploited in the wild, and the CVE is not in the CISA KEV list.
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. In that scoring, a low privilege account, such as an ordinary logged in user, is needed. The weaknesses are CWE-74 (injection) and CWE-89 (SQL injection). Impact scores are low in each of confidentiality, integrity and availability, which is why the number stays below Critical.
The record names no fixed version and no vendor patch. The same product has other SQL injection entries from the same series of reports: CVE-2025-3118. If you run this software, fix them all in one pass.
How to check if you're exposed
Start with an inventory of web applications that use this code base. Many small PHP projects get installed once and forgotten, so search the file system:
find / -type f -name "manage_course.php" -not -path "*/proc/*" 2>/dev/null
For each hit, open the file and find where the ID value is used. If it is concatenated into a query string, the code matches the record. Next, check whether the application is reachable from the internet. From a machine outside your network, request the path /tutor/courses/manage_course.php on your site and see if it answers, or check your reverse proxy and firewall rules.
Last, review the database account the application uses. If it is a highly privileged account, the impact of an injection is larger than the score suggests.
What to do now
- Check the vendor's site and the public report for a patched release. The record names none, so do not assume one exists.
- Take the application off the public internet, or put it behind a VPN, an IP allowlist or HTTP authentication until the code is fixed.
- Rewrite the query that uses the
IDparameter in/tutor/courses/manage_course.phpto use prepared statements with bound values. Example:
$stmt = $con->prepare("SELECT * FROM records WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();
That is an illustration for a PHP and MySQL stack, with a stand in table name. Use the right type letter for each value, and apply the same change to every query in the file, not only the one named in the record. 4. Run the application's database account with the least privileges it needs. It should not own the schema or be able to read other databases. 5. Review access logs and database contents for signs of misuse, and rotate any credentials stored in the database if you see any.
Why it matters
This record is another example of the plain concatenation bug. The application takes the ID value from a request and places it inside an SQL statement. The database cannot tell which part is the developer's command and which part is the visitor's data. The attached weakness classes are CWE-74 for injection and CWE-89 for SQL injection.
The fix is not clever. Use prepared statements with bound parameters for every query, validate the type of each input, and give the database account only the rights it needs. Source code projects of this kind are often downloaded as starting points or learning material, then deployed with little change. If that describes your Online Tutor Portal installation, you own its security from the first day, and a code review for string built queries is the right next step.
A practical point for defenders: the record says a public exploit exists, so scanners and curious visitors can find the page fast. Even though the CVSS score is only 6.3, an internet facing page that talks to a database with customer or patient style records deserves the same care as a higher scored bug.
Quick check
Is there a patched version of Online Tutor Portal?
The record lists no fixed version. Check the vendor's site and the public report, and if nothing is published, fix the query in /tutor/courses/manage_course.php yourself or take the application out of service.
Does a firewall rule fix this?
It reduces exposure, but the flaw stays in the code. A web application firewall can block some probes. The real fix is a parameterized query in /tutor/courses/manage_course.php.
Sources
Last reviewed: 19 October 2026.
