CVE-2025-67404 identifies an SQL Injection vulnerability in Sourcecodester CASAP Automated Enrollment System version 1.0. The vulnerability exists in the save_stud.php file and can be triggered via the fname, lname, and student_class parameters. This flaw could allow an attacker to manipulate backend SQL queries, potentially leading to unauthorized data access or modification. No CVSS score or vendor advisory is provided, and no patch or mitigation details are available at this time.

Successful exploitation of this SQL Injection vulnerability could allow an attacker to execute arbitrary SQL commands on the database used by the enrollment system. This may result in unauthorized data disclosure, data modification, or other database-related impacts depending on the database privileges of the application. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to implement input validation and parameterized queries to mitigate SQL Injection risks in the affected parameters (fname, lname, student_class).