School Fees Payment System - SQLi (CVE-2025-6403)
Description
A vulnerability was found in code-projects School Fees Payment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
psychologyCrowdSec Analysis
CVE-2025-6403 is a critical SQL injection vulnerability in code-projects School Fees Payment System 1.0, specifically affecting the /student.php file via the ID parameter. This flaw allows remote attackers to manipulate database queries, potentially leading to unauthorized data access or modification. With public exploit code available, the risk of real-world attacks is significantly heightened.
CrowdSec has been tracking this vulnerability and its exploits since 19th of November 2025.
Data from the CrowdSec community indicates that exploitation of CVE-2025-6403 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. CrowdSec network telemetry also shows that exploitation of CVE-2025-6403 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.
Attackers exploit the /student.php endpoint by injecting SQL commands into the id parameter, often using payloads like EXTRACTVALUE or SLEEP to trigger errors or time delays, indicating successful SQL injection attempts.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-06-21 |
| Rule Released | 2025-11-19 |
| CrowdSec First Seen | 2025-11-27 |
Related Weaknesses
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.