CVE-2025-67407 identifies a SQL Injection vulnerability in Sourcecodester CASAP Automated Enrollment System version 1.0. The vulnerability exists in the update_student.php file, specifically through the fname and student_class parameters, which do not properly sanitize user input before incorporating it into SQL queries. This flaw could allow an attacker to execute arbitrary SQL commands against the backend database. No CVSS score or vendor advisory is available, and no patch or mitigation guidance has been published.

Successful exploitation of this SQL Injection vulnerability could allow an attacker to read, modify, or delete data in the backend database of the enrollment system. This may lead to unauthorized disclosure of sensitive student information or manipulation of enrollment records. The absence of known exploits in the wild suggests limited current active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to apply input validation and parameterized queries to the affected parameters (fname and student_class) to mitigate the risk of SQL Injection.