CVE-2025-11343

Executive Summary

CVE-2025-11343 is a SQL injection vulnerability in code-projects Student Crud Operation version 3.3, affecting an unknown function of the file delete.php where manipulation of the ID argument permits injection of SQL statements. The flaw is remotely exploitable without authentication or user interaction, and a public exploit has been disclosed, meaning weaponized or copy-paste attacks against internet-exposed deployments are likely. No vendor patch exists, leaving operators to rely on compensating controls such as WAF filtering, network restriction, and code-level parameterization of the vulnerable query.

Technical Analysis

The CNA title and NVD description identify a classic SQL injection (SQLi) issue in the delete.php script of the Student Crud Operation application, version 3.3. The application is a PHP-based CRUD (create, read, update, delete) student records management system distributed by the code-projects project family — lightweight, database-backed web applications frequently deployed for coursework, demos, and small internal record-keeping.

The injection point is the ID argument consumed by delete.php. The description states that "the manipulation of the argument ID leads to sql injection," which is consistent with the most common pattern in such scripts: the delete handler takes an identifier from the request (typically via GET) and interpolates it directly into a SQL DELETE statement without parameterization or input validation. Because the application is a student-record manager, the underlying store is a relational database (MySQL is the conventional backend for this class of PHP application) whose credentials and records become accessible to an attacker who can control the query string.

Two properties elevate this vulnerability beyond a trivial bug:

1. Unauthenticated remote reachability. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms that the attack can be carried out remotely, over the network, with low complexity, no privileges, and no user interaction. An exposed delete.php can therefore be attacked by any network-reachable client.
2. Data-destructive semantics. The endpoint's legitimate function is deletion. Even a non-crafted request deletes a record; a crafted request can alter the scope of the DELETE so that it affects arbitrary rows or performs stacked/secondary operations, depending on how the query is assembled and which database driver is in use.

The CWE classification recorded here is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, 'Injection'), the parent class that encompasses SQL injection. The canonical CWE for SQL injection proper is CWE-89; the metadata reflects the CWE entry supplied with the CVE record. From a defensive standpoint the two are equivalent in remediation terms: the parameter reaching the database is not neutralized before it is incorporated into a query.

It is important to be precise about what the public record does not state. The NVD description does not name the vulnerable function, does not specify the HTTP method, does not identify the database engine, and does not describe the query construction. No public Nuclei template or exploit code is recorded in the data supplied, although the exploit has been disclosed publicly. The technical claims above are therefore confined to the vulnerability class and the artifact (delete.php, argument ID) that the CNA explicitly names; any specific payload syntax or column-count detail would be speculation and is deliberately omitted.

Exploitation Scenarios

Because the exploit is publicly disclosed but no template or code is recorded in this dataset, the attack chain below is described at the vulnerability-class level. No public PoC artifact is available in the supplied data; the sequence is inferred from the injection class and the named endpoint.

Step 1 — Reconnaissance and target identification. An adversary enumerates internet-facing hosts running the Student Crud Operation application. Candidate identification is straightforward: the application presents a known web UI title and a predictable script layout, including the delete.php handler. Shodan-style queries for the application title or for the delete.php?id= pattern surface candidate hosts, and automated scanners that fingerprint PHP CRUD applications will flag them. No authentication is required to reach the vulnerable endpoint (PR:N), so the reconnaissance phase does not need to obtain credentials.

Step 2 — Triggering the flaw. The attacker issues a request to delete.php and supplies a crafted value for the ID argument rather than a plain integer. A well-formed request deletes one student record; a malformed or injected value causes the application to build and execute a SQL statement that the developer did not intend. Because the argument is reflected into the query rather than bound as a parameter, the attacker controls the structure of the statement, not merely its value.

Step 3 — Execution at the class level. In the SQLi class, the attacker's goal at this stage is to break out of the intended literal/identifier context and append or reshape SQL. Typical class-level objectives are: (a) broadening the scope of the delete so that it affects rows beyond the intended single record; (b) causing the backend to return data in an error or response that leaks schema and record content; and (c) where the driver and query API permit, chaining additional statements. For a destructive endpoint, objective (a) alone is a denial-of-service/data-loss event: an attacker can mass-delete records even without exfiltrating anything. Where error output or boolean/UNION behavior is possible, objective (b) converts the endpoint into a read primitive against the student database.

Step 4 — Post-exploitation impact. Depending on the database account the application uses, outcomes range from unauthorized deletion or modification of student records (integrity and availability loss) to disclosure of the contents of the underlying tables and, in the worst case, reading of other database objects reachable by that account. The CVSS subscores (C:L/I:L/A:L) model limited but non-trivial impact across all three pillars. The absence of a patch means a successful compromise is not remediated by upgrading the application; the attacker's access persists until the query is fixed or the endpoint removed.

Impact Assessment

CVE-2025-11343 carries a base score of 7.3 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Reading the vector:

• AV:N / AC:L / PR:N / UI:N — the vulnerability is reachable across a network, requires no special conditions to exploit, requires no prior authentication, and requires no action by a legitimate user. The practical consequence is that any host exposing delete.php is directly attackable.
• S:U — the impact is scoped to the vulnerable component (the application and the database it uses), rather than demonstrably crossing a security authority boundary.
• C:L / I:L / A:L — limited confidentiality, integrity, and availability impact. For a student-record CRUD application this translates to: disclosure of some database contents (confidentiality), unauthorized modification or deletion of records (delete.php is inherently destructive, so integrity and availability both degrade), and potential disruption of the application's function if records required by the UI are removed.

Blast radius. The direct blast radius is limited to the application and its database. The realistic organizational impact depends on where the application is deployed. A throwaway classroom or lab instance represents low business risk. A production instance holding real student PII or used as a system of record raises the impact considerably: student records are regulated data in many jurisdictions, deletion or alteration of records can trigger data-integrity and breach-notification obligations, and the combination of "destructive endpoint" plus "unauthenticated SQLi" makes accidental or opportunistic data loss plausible rather than theoretical.

Exploit likelihood. EPSS is 0.00413, at the 33.6th percentile of all scored CVEs — this signals that mass exploitation in the immediate term is not expected to be widespread. However, EPSS is a probabilistic daily estimate, not a guarantee, and the following factors raise risk above what the EPSS number alone suggests: the exploit has been publicly disclosed, exploitation requires no authentication, and the vulnerable software is a small, widely forked academic project that is unlikely to receive a vendor patch. CISA KEV does not list this CVE, so there is no confirmed in-the-wild campaign in the official catalog. The combination should be read as: broad, low-effort opportunistic scanning is plausible; targeted, high-effort exploitation is not indicated by the available data.

Detection Guidance

Detection for this vulnerability relies on observing SQLi-shaped input to delete.php at the network and web-server layers, and on correlating application and database behavior at the host layer. The rules below are written to the named artifacts in the CVE record (delete.php, the ID argument) and to generic SQL-injection signatures; they do not assume a specific database engine.

Sigma Rule

title: SQL Injection Attempt Against delete.php ID Parameter (CVE-2025-11343)
id: 8f4c1d2e-7b91-4a6f-9c33-2d5e6a0b7f11
status: experimental
description: Detects SQL injection payloads submitted to the ID parameter of delete.php in code-projects Student Crud Operation 3.3 (CVE-2025-11343).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-11343
author: valtersit.com
date: 2025-11-01
logsource:
  category: webserver
  product: apache
detection:
  selection_uri:
    cs-uri-stem|endswith: '/delete.php'
  selection_payload:
    cs-uri-query|contains:
      - "'"
      - '"'
      - '--'
      - '#'
      - ' UNION '
      - 'SELECT '
      - ' OR '
      - ' AND '
      - 'SLEEP('
      - 'BENCHMARK('
      - 'pg_sleep'
      - 'information_schema'
      - '0x'
  condition: selection_uri and selection_payload
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate administrative tooling that quotes identifiers (rare for a numeric ID)
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2025.11343
  - cwe.74

YARA Rule

rule CVE_2025_11343_Student_Crud_SQLi_Request
{
    meta:
        description = "Detects HTTP request artifacts targeting the ID parameter of delete.php (CVE-2025-11343, code-projects Student Crud Operation 3.3)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-11343"
        date = "2025-11-01"
        severity = "high"

    strings:
        $ep = "delete.php" ascii nocase wide
        $id = "?id=" ascii nocase wide
        $ampid = "&id=" ascii nocase wide
        $sqli1 = "'" ascii
        $sqli2 = "UNION SELECT" ascii nocase
        $sqli3 = " OR 1=1" ascii nocase
        $sqli4 = "SLEEP(" ascii nocase
        $sqli5 = "BENCHMARK(" ascii nocase
        $sqli6 = "information_schema" ascii nocase
        $sqli7 = "--" ascii

    condition:
        $ep and ($id or $ampid) and any of ($sqli*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"WEB-ATTACKS SQL Injection attempt to delete.php ID parameter (CVE-2025-11343)"; flow:established,to_server; http.uri; content:"/delete.php"; nocase; http.uri; content:"id="; nocase; pcre:"/(id=)[^&]*(%27|'|\"|--|%2D%2D|UNION|SELECT|SLEEP\(|BENCHMARK\(|information_schema)/iU"; classtype:web-application-attack; reference:cve,2025-11343; reference:url,nvd.nist.gov/vuln/detail/CVE-2025-11343; sid:2025114301; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where event.category == "network" and
      url.path != null and endsWith(url.path, "/delete.php") and
      url.query != null and
      (url.query : "*'*" or url.query : "*\"*" or url.query : "* UNION *" or
       url.query : "* SELECT *" or url.query : "*information_schema*" or
       url.query : "*SLEEP(*" or url.query : "*BENCHMARK(*") ]
  [ network where event.category == "network" and
      url.path != null and endsWith(url.path, "/delete.php") and http.response.status_code == 500 ]

Splunk SPL Query

index=web sourcetype=access_common
| eval uri=lower(uri)
| where like(uri, "%delete.php%") AND (like(uri, "%id=%")
    AND (like(uri, "%27%") OR like(uri, "%22%") OR like(uri, "%2d%2d%")
      OR like(uri, "%union%") OR like(uri, "%select%")
      OR like(uri, "%sleep(%") OR like(uri, "%benchmark(%")
      OR like(uri, "%information_schema%")))
| stats count min(_time) as first_seen max(_time) as last_seen
        values(status) as status_codes dc(uri) as unique_uris
        by src_ip, uri
| where count >= 3
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,appsec,sql_injection,">
  <rule id="100143" level="12">
    <if_sid>31100</if_sid>
    <id>^31103$</id>
    <match>delete\.php</match>
    <regex>(%27|%22|%2d%2d|union|select|sleep\(|benchmark\(|information_schema)</regex>
    <description>CVE-2025-11343: SQL injection attempt against delete.php ID parameter (code-projects Student Crud Operation 3.3)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2025_11343,pci_dss_6.5.1,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, advisory, or package-level fix has been identified by any tracked source. There is no version of Student Crud Operation 3.3 that is known to correct this issue, and no upgrade path is available. Remediation must therefore be compensating and code-level.

1) Immediate mitigations (hours to days):

• Remove or disable delete.php from public reach. The most direct control is to take the vulnerable endpoint out of service or restrict access to it. If deletion functionality is not required for the deployment's purpose, deleting or renaming the script eliminates the attack surface entirely.
• Restrict network access. Place the application behind a reverse proxy, VPN, or IP allow-list so that only trusted administrative networks can reach delete.php. The vulnerability is only exploitable remotely (AV:N); eliminating remote reachability eliminates the practical attack.
• Deploy a virtual patch / WAF rule. Apply the Suricata/Sigma/WAF logic above in blocking mode to reject requests where the ID argument contains SQL metacharacters, quote characters, comment sequences, or SQL keywords. Note that WAFs are bypassable and must be treated as defense-in-depth, not as the fix.
• Harden the database account. Ensure the application's database user has privileges only on the specific database and tables it needs, with no FILE, no INTO OUTFILE, and no cross-schema grants. This narrows what a successful injection can reach and mitigates the confidentiality impact (C:L).
• Ensure error handling does not leak SQL. Suppress detailed database errors from HTTP responses; verbose errors turn a blind-input injection into a schema-disclosure primitive.

2) Patch / upgrade steps:

• There is no vendor patch. Monitor the code-projects project distribution channel and the NVD record for CVE-2025-11343 for any future advisory or corrected version. Until one appears, do not assume an "upgrade" resolves the issue.
• Remediate in source. The definitive fix is to eliminate the injection at the code level: convert the delete.php query from string interpolation of the ID argument to a parameterized prepared statement (bind the identifier as an integer), and add strict server-side validation that ID is a well-formed integer before it reaches the database. This removes the flaw class regardless of whether the upstream project ever ships a fix.
• Fork and maintain. Because the maintainer is unlikely to respond, treat the code as locally owned and maintain a patched fork for any instance that must remain deployed.

3) Long-term hardening:

• Apply secure-development practices to the entire application, not just delete.php: audit every script that consumes user-supplied identifiers or filters and parameterize all queries.
• Enforce input validation at the trust boundary (whitelist integer IDs; reject anything else).
• Apply least-privilege database roles as a standing control so that a future injection is contained.
• Retire unsupported, unmaintained web applications from production use; where they must persist, isolate them on a segmented network with no access to sensitive data stores.
• Add the detection rules above to SOC coverage and monitor for repeated delete.php probing as an early indicator of opportunistic scanning.

References

1. NVD — CVE-2025-11343: https://nvd.nist.gov/vuln/detail/CVE-2025-11343
2. MITRE CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'): https://cwe.mitre.org/data/definitions/74.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. FIRST EPSS — exploit prediction scoring for CVE-2025-11343 (score 0.00413, 33.6th percentile): https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2025-11343 not listed — no confirmed in-the-wild campaign recorded as of this writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild note: No named threat actor, campaign, or confirmed in-the-wild exploitation is associated with CVE-2025-11343 in the data provided. CISA KEV does not list the CVE. The exploit has been publicly disclosed and may be used, and no public Nuclei template or packaged exploit code is recorded — consistent with opportunistic, script-level abuse rather than a tracked adversary operation.