CVE-2025-67404 identifies an SQL Injection vulnerability in Sourcecodester CASAP Automated Enrollment System version 1.0. The flaw exists in the save_stud.php file where the parameters fname, lname, and student_class are not properly sanitized, allowing remote attackers to inject malicious SQL queries. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database. This can lead to unauthorized data disclosure, data modification, or deletion, and potentially full system compromise depending on the database privileges. The critical CVSS score reflects the high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the vulnerable parameters. Input validation and parameterized queries should be applied as a long-term mitigation once source code access is possible.