CVE-2025-14257 is a high severity SQL injection (CVSS 7.3) in itsourcecode Student Management System, version 1.0. The flaw sits in /newrecord.php, where the ID parameter reaches a database query unsafely and can be abused over the network. The record lists no fixed release, so limit exposure now and plan to patch the query or replace the application.
This post covers what the record says, how to check whether you run the affected code, and what to do while no vendor fix is on file. The weakness is tracked as CWE-89 (SQL injection), a child of CWE-74 (injection). The entry for this CVE is on the Gold page for CVE-2025-14257.
What's affected
- Product: itsourcecode Student Management System.
- Affected version: 1.0.
- Affected file:
/newrecord.php, parameterID. - Fixed version: none is named in the record. Check the product page and the public report listed under Sources before assuming a patch exists.
- Severity: High, CVSS 7.3, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. - Known Exploited Vulnerabilities (KEV) status: not listed in CISA KEV.
The vector tells you how this is reached: over the network, with low attack complexity and no user interaction. Some of these records need a logged in user (the privileges required field in the vector shows which). Either way, the description says the attack can be started remotely and that a public disclosure exists.
How to check if you're exposed
Small PHP applications like this are often installed once from a download site or tutorial, then left running with the original code and a database account that can do far too much. Nobody owns patches for them, which is why they show up in scanner results long after the first disclosure.
Work through these checks:
- Search your inventory, repositories and web server document roots for the product name and for the file
newrecord.php. - If you find it, open the file and read how
IDreaches the SQL statement. A query built by joining strings is the pattern to look for. - Look at your web server access logs for requests to that file from addresses you do not recognize, and at database logs for errors or unusually shaped queries around the same time.
- Check which database account the application uses and what it can read and change.
Our free in-browser dependency scan covers packages declared in a manifest. It will not see a copy of this application dropped into a web root, so the file search above is the part that counts.
What to do now
- Find every copy of itsourcecode Student Management System you run, including test and demo installs.
- If it is internet facing and not essential, take it offline or put it behind a login, a VPN or an IP allow list.
- Replace string built SQL in
newrecord.phpwith prepared statements and bound parameters, and review neighboring files for the same pattern, since the code base likely repeats it. - Reduce the database account to the minimum rights the application needs, and make sure it cannot reach other databases.
- Rotate any credentials stored in the application database if you have reason to think it was queried by someone else.
- Watch the project and the NVD record for a fixed release, and if none appears, plan to retire the application.
Why it matters
SQL injection happens when an application builds a database query by joining text from the request into the query string. The database cannot tell which part was meant as data and which part was meant as instructions, so a crafted value can change what the query does. The usual remedy is a parameterized query (a prepared statement), where the query shape is fixed first and values are bound afterwards.
The record gives this a base score of 7.3, and a public write up exists, so the effort needed to find and misuse the issue is low. The scope of the damage is whatever the application's database account can reach, which for small apps is often everything in the schema, including user records and password hashes.
For an unmaintained application the practical risk is time. A fix that nobody ships stays open, and scanners and attackers both find old code by its public identifiers. Treat the file and parameter named in the record as a pointer to a wider pattern, not as the only affected spot.
Quick check
Is there a patch for CVE-2025-14257?
The record does not name a fixed version. Read the public report and the project page for the current state, and if nothing is published, fix the query yourself or retire the application.
Is CVE-2025-14257 exploited in the wild?
The record does not mark it as exploited. It is not in CISA KEV. The description does say a public disclosure exists, so the issue should be treated as easy to find.
Sources
- NVD record data for CVE-2025-14257 (Safeguard Gold entry)
- Public report
- Public report
Last reviewed: 19 October 2026.
