# CVE-2025-6403: School Fees Payment System - SQLi

> Live exploitation tracking for CVE-2025-6403 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-6403

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 6.9
- **Public exploit available:** Yes
- **Affected products:** code-projects School Fees Payment System
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')); CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'))
- **Tags:** enterprise_software

## Description

A vulnerability was found in code-projects School Fees Payment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

## CrowdSec analysis

[CVE-2025-6403](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-6403) is a critical SQL injection vulnerability in code-projects School Fees Payment System 1.0, specifically affecting the /student.php file via the ID parameter. This flaw allows remote attackers to manipulate database queries, potentially leading to unauthorized data access or modification. With public exploit code available, the risk of real-world attacks is significantly heightened.

CrowdSec has been tracking this vulnerability and its exploits since 19th of November 2025.

Data from the CrowdSec community indicates that exploitation of CVE-2025-6403 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations.
CrowdSec network telemetry also shows that exploitation of CVE-2025-6403 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit the `/student.php` endpoint by injecting SQL commands into the `id` parameter, often using payloads like `EXTRACTVALUE` or `SLEEP` to trigger errors or time delays, indicating successful SQL injection attempts.

## Timeline

- 2025-06-21: CVE Published. CVE-2025-6403 is published to NVD.
- 2025-11-19: Rule Released. CrowdSec releases a rule to detect CVE-2025-6403 exploitation attempts against the CrowdSec Network.
- 2025-11-27: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-6403 for the first time.

## References

- https://vuldb.com/?submit.597758
- https://vuldb.com/?id.313397
- https://github.com/tuooo/CVE/issues/16
- https://code-projects.org/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-6403.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-6403) follows observed exploitation activity for CVE-2025-6403. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.