PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-67408 Sourcecodester CVE debrief

A SQL injection vulnerability exists in Sourcecodester CASAP Automated Enrollment System 1.0, specifically in the /save_user.php file via the 'status' parameter. This issue allows attackers to inject malicious SQL code, potentially leading to unauthorized access, data manipulation, or information disclosure. The vulnerability poses a significant risk to systems that have not been patched, allowing attackers to exploit this weakness and gain unauthorized access to sensitive data, manipulate data, or disclose information. Defenders should assess their exposure, apply patches or workarounds, and monitor for potential exploitation attempts to mitigate the risk. The CVE record and NVD  

Vendor
Sourcecodester
Product
CASAP Automated Enrollment System 1.0
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-29
Original CVE updated
2026-10-13
Advisory published
2026-07-29
Advisory updated
2026-10-13

Who should care

Defenders responsible for systems using the Sourcecodester CASAP Automated Enrollment System 1.0 should assess their exposure and take steps to mitigate the vulnerability.

Why it matters

This SQL injection vulnerability in the Sourcecodester CASAP Automated Enrollment System 1.0 poses a significant risk to systems that have not been patched. Defenders should prioritize verifying the presence of this vulnerability in their systems, applying patches or workarounds, and monitoring for potential exploitation attempts.

  • Potential unauthorized access to sensitive data
  • Possible data manipulation or corruption
  • Information disclosure risks due to malicious SQL injection

Technical summary

The Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in the /save_user.php file via the 'status' parameter. This allows attackers to inject malicious SQL code, potentially leading to unauthorized access, data manipulation, or information disclosure.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their systems, applying patches or workarounds, and monitoring for potential exploitation attempts.

Recommended defensive actions

  • Verify the presence of the vulnerable component in your system
  • Apply patches or workarounds to address the SQL injection vulnerability
  • Monitor for potential exploitation attempts

Evidence notes

The CVE record and NVD entry provide details about the SQL injection vulnerability in Sourcecodester CASAP Automated Enrollment System 1.0. However, additional information about affected versions, exploitation, or remediation is limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-67408 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-67408

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-67408 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-67408

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-save_user.php-status-sqli/20250811-casap-automated-enrollment-system-save_user.php-status-sqli.md

    [email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.