Cyber Posture

CVE-2025-70152

CriticalPublic PoC

Published: 18 February 2026

Published
18 February 2026
Modified
23 February 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 36.5th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/save_user.php and /admin/update_user.php. These endpoints lack authentication checks and directly concatenate user-supplied POST parameters (firstname, lastname, username, password, user_id) into SQL queries…

more

without validation or parameterization.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Requires validation of user-supplied POST parameters prior to use in SQL queries, directly preventing SQL injection exploitation.

IA-2 Identification and Authentication (Organizational Users) good match
prevent

Mandates identification and authentication for organizational users accessing admin endpoints, mitigating the lack of authentication checks.

AC-3 Access Enforcement good match
prevent

Enforces logical access controls to block unauthenticated remote attackers from reaching vulnerable admin user management endpoints.

Security SummaryAI

CVE-2025-70152 is a critical SQL injection vulnerability (CWE-89) affecting the code-projects Community Project Scholars Tracking System 1.0. The flaw resides in the admin user management endpoints /admin/save_user.php and /admin/update_user.php, which lack authentication checks and directly concatenate user-supplied POST parameters—including firstname, lastname, username, password, and user_id—into SQL queries without validation or parameterization. Published on 2026-02-18, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its high severity due to network accessibility and comprehensive impact potential.

Any unauthenticated remote attacker can exploit this vulnerability by sending crafted POST requests to the affected endpoints, requiring no privileges or user interaction. Successful exploitation enables arbitrary SQL injection, granting high-level impacts on confidentiality (e.g., data exfiltration), integrity (e.g., user record manipulation), and availability (e.g., denial of service via destructive queries), potentially leading to full database compromise.

Mitigation guidance is available in referenced advisories, including the project source code at https://code-projects.org/scholars-tracking-system-in-php-with-source-code/ and a detailed analysis at https://youngkevinn.github.io/posts/CVE-2025-70152-Scholars-SQLi-Missing-Auth/. Practitioners should review these for patching instructions or secure coding recommendations, such as implementing parameterized queries and authentication controls.

Details

CWE(s)
CWE-89

Affected Products

fabian
scholars tracking system
1.0

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in unauthenticated admin endpoints of a public-facing web application directly enables T1190 (Exploit Public-Facing Application) and facilitates T1213.006 (Data from Information Repositories: Databases) through arbitrary SQL queries for data exfiltration, manipulation, and potential DoS.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References