CVE-2025-67403 identifies a SQL Injection vulnerability in Sourcecodester CASAP Automated Enrollment System 1.0. The flaw exists in the update_class.php file where the class_name parameter is not properly sanitized, allowing remote attackers to inject and execute arbitrary SQL queries. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database. This can lead to unauthorized data disclosure, data modification, or deletion, and potentially full system compromise depending on the database privileges. The high CVSS score reflects the critical nature of this vulnerability with complete impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to implement input validation and parameterized queries on the class_name parameter to mitigate SQL Injection risks. Restricting database user privileges and monitoring for suspicious database activity may also help reduce risk.