CVE-2025-67408: n/a
Sourcecodester CASAP Automated Enrollment System version 1.0 contains a SQL Injection vulnerability in the /save_user.php script via the 'status' parameter. This vulnerability allows an unauthenticated attacker to execute arbitrary SQL commands, potentially leading to data disclosure, modification, or denial of service. The vulnerability has a CVSS 3.1 base score of 7.3, indicating high severity. There is no information about an available patch or official remediation at this time.
AI Analysis
Technical Summary
CVE-2025-67408 identifies a SQL Injection vulnerability in Sourcecodester CASAP Automated Enrollment System 1.0. The flaw exists in the /save_user.php endpoint where the 'status' parameter is not properly sanitized, allowing remote attackers to inject SQL commands. This vulnerability is unauthenticated and exploitable over the network with low attack complexity and no user interaction required. The impact includes potential confidentiality, integrity, and availability loss of the affected system's data.
Potential Impact
Successful exploitation can lead to unauthorized disclosure of sensitive information, unauthorized data modification, and disruption of service availability. Given the vulnerability is remotely exploitable without authentication and has low complexity, it poses a significant risk to affected systems running the specified version.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'status' parameter.
CVE-2025-67408: n/a
Description
Sourcecodester CASAP Automated Enrollment System version 1.0 contains a SQL Injection vulnerability in the /save_user.php script via the 'status' parameter. This vulnerability allows an unauthenticated attacker to execute arbitrary SQL commands, potentially leading to data disclosure, modification, or denial of service. The vulnerability has a CVSS 3.1 base score of 7.3, indicating high severity. There is no information about an available patch or official remediation at this time.
CVSS v3.1
Score 7.3high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-67408 identifies a SQL Injection vulnerability in Sourcecodester CASAP Automated Enrollment System 1.0. The flaw exists in the /save_user.php endpoint where the 'status' parameter is not properly sanitized, allowing remote attackers to inject SQL commands. This vulnerability is unauthenticated and exploitable over the network with low attack complexity and no user interaction required. The impact includes potential confidentiality, integrity, and availability loss of the affected system's data.
Potential Impact
Successful exploitation can lead to unauthorized disclosure of sensitive information, unauthorized data modification, and disruption of service availability. Given the vulnerability is remotely exploitable without authentication and has low complexity, it poses a significant risk to affected systems running the specified version.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'status' parameter.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2025-12-08T00:00:00.000Z
- State
- PUBLISHED
Threat ID: 6a6a7d309c2644c7f81e4075
Added to database: 07/29/2026, 22:22:40 UTC
Last enriched: 08/06/2026, 17:54:25 UTC
Last updated: 09/10/2026, 20:00:48 UTC
Views: 72
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.