CVE-2025-14334 is a high severity SQL injection (CVSS 7.3) in itsourcecode Student Management System, version 1.0. The flaw sits in /new_adviser.php, where the Name parameter reaches a database query unsafely and can be abused over the network. The record lists no fixed release, so limit exposure now and plan to patch the query or replace the application.
This post covers what the record says, how to check whether you run the affected code, and what to do while no vendor fix is on file. The weakness is tracked as CWE-89 (SQL injection), a child of CWE-74 (injection). The entry for this CVE is on the Gold page for CVE-2025-14334.
What's affected
- Product: itsourcecode Student Management System.
- Affected version: 1.0.
- Affected file:
/new_adviser.php, parameterName. - Fixed version: none is named in the record. Check the product page and the public report listed under Sources before assuming a patch exists.
- Severity: High, CVSS 7.3, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. - Known Exploited Vulnerabilities (KEV) status: not listed in CISA KEV.
The vector tells you how this is reached: over the network, with low attack complexity and no user interaction. Some of these records need a logged in user (the privileges required field in the vector shows which). Either way, the description says the attack can be started remotely and that a public disclosure exists.
How to check if you're exposed
Applications of this type tend to be copied from a code sample site into a school project, an internal tool or a small shop. They rarely have a release process, so a published issue can stay open for good. Treat any copy you find as unmaintained code that you now own.
Work through these checks:
- Search your inventory, repositories and web server document roots for the product name and for the file
new_adviser.php. - If you find it, open the file and read how
Namereaches the SQL statement. A query built by joining strings is the pattern to look for. - Look at your web server access logs for requests to that file from addresses you do not recognize, and at database logs for errors or unusually shaped queries around the same time.
- Check which database account the application uses and what it can read and change.
Our free in-browser dependency scan covers packages declared in a manifest. It will not see a copy of this application dropped into a web root, so the file search above is the part that counts.
What to do now
- Find every copy of itsourcecode Student Management System you run, including test and demo installs.
- If it is internet facing and not essential, take it offline or put it behind a login, a VPN or an IP allow list.
- Replace string built SQL in
new_adviser.phpwith prepared statements and bound parameters, and review neighboring files for the same pattern, since the code base likely repeats it. - Reduce the database account to the minimum rights the application needs, and make sure it cannot reach other databases.
- Rotate any credentials stored in the application database if you have reason to think it was queried by someone else.
- Watch the project and the NVD record for a fixed release, and if none appears, plan to retire the application.
Why it matters
The weakness is an old and well understood one. Input from the request reaches a SQL statement without being kept apart from the statement itself. Validation and escaping help at the edges, but the dependable fix is a prepared statement with bound parameters, together with a database account that only holds the privileges the page truly needs.
The record gives this a base score of 7.3, and a public write up exists, so the effort needed to find and misuse the issue is low. The scope of the damage is whatever the application's database account can reach, which for small apps is often everything in the schema, including user records and password hashes.
For an unmaintained application the practical risk is time. A fix that nobody ships stays open, and scanners and attackers both find old code by its public identifiers. Treat the file and parameter named in the record as a pointer to a wider pattern, not as the only affected spot.
Quick check
Is there a patch for CVE-2025-14334?
The record does not name a fixed version. Read the public report and the project page for the current state, and if nothing is published, fix the query yourself or retire the application.
Is CVE-2025-14334 exploited in the wild?
The record does not mark it as exploited. It is not in CISA KEV. The description does say a public disclosure exists, so the issue should be treated as easy to find.
Sources
- NVD record data for CVE-2025-14334 (Safeguard Gold entry)
- Public report
Last reviewed: 19 October 2026.
