CVE-2025-3684 is a Medium severity (CVSS 6.3) SQL injection in Xianqi Kindergarten Management System 2.0 Build 20190808. The sex parameter in the child management page stu_list.php is the weak point. The record names no fix, so restrict access and fix the query.
What's affected
The record names Xianqi Kindergarten Management System 2.0 Build 20190808. The vulnerable code is the file stu_list.php in the Child Management component, through the sex parameter. The record notes that other parameters might be affected as well.
The record names no fixed version, and I found no vendor advisory. Treat the product as unpatched until its maker says otherwise.
How to check if you're exposed
Start by finding out whether you run the product. Check web server document roots, container images and old project folders for it, and look at the version in the admin area or the installed files.
If you do run it, review web server and database logs for unusual requests to that page, especially ones containing quote characters, SQL keywords or very long values in the parameter. Unexpected database errors in the application log are another sign. Do not test the flaw against a system you do not own.
What to do now
- Locate every copy of the application, including test and demo installs.
- Take it off the internet or put it behind a VPN or an IP allow list until it is fixed.
- Ask the vendor or project for a fix, and watch the advisory sources for one.
- If you can change the code, switch the query to a parameterised statement and validate the value as the type it should be.
- Use a database account with only the access the application needs, so a flaw cannot reach other data.
- Back up the database, and review it and your logs for signs of tampering.
Why it matters
The weakness is CWE-74 (Injection), CWE-89 (SQL Injection). The application builds a database query by joining text that comes from the request into the SQL statement. Because the database cannot tell the developer's SQL from the attacker's text, crafted input changes what the query does. The usual impact is reading or changing data in the database, and sometimes more.
The vector is network, low complexity, low privileges and no interaction, with low impact on each of confidentiality, integrity and availability, giving 6.3.
The data matters more than the score. A system that manages children holds personal details about minors and their families, which carry legal duties in many places. The record says other parameters might also be affected, so fixing only the one named parameter is not enough. Review every place the application builds a query. The record also says the exploit has been disclosed to the public.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is only the sex parameter affected?
No. The record says other parameters might be affected as well, so review every query in the page and the application.
Why does the data matter?
The system holds records about children, so a breach has privacy and legal consequences beyond the CVSS score.
Sources
Last reviewed: 18 October 2026.
