CVE-2025-15198

Executive Summary

CVE-2025-15198 is an unpatched SQL injection vulnerability in code-projects College Notes Uploading System 1.0, affecting the login interface at /login.php through manipulation of the User argument. The flaw is remotely exploitable without authentication or user interaction and carries a CVSS base score of 7.3 (High). Public exploit code is available, and because the affected product is a web-based notes management application commonly deployed by educational institutions, exploitation can lead to authentication bypass, unauthorized database reads, and potential data tampering.

Technical Analysis

The vulnerability resides in the login processing logic of College Notes Uploading System version 1.0. According to the CNA advisory, the affected file is /login.php, and the specific attack vector is manipulation of the User argument. The application fails to properly sanitize or parameterize this input before incorporating it into a database query, allowing an attacker to alter the intended SQL statement structure.

The flaw is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, commonly referred to as Injection). In practice, this manifests as classic SQL injection: when the User parameter is supplied to the backend, it is concatenated into a SQL query rather than passed as a bound parameter. An attacker can inject SQL syntax to modify query logic, thereby bypassing authentication checks or extracting arbitrary data from the underlying database.

The NVD description explicitly states that the vulnerability affects "some unknown processing of the file /login.php" and that a "manipulation of the argument User" leads to SQL injection. The advisory does not disclose the underlying database engine, the exact query construction, or the result rendering behavior. Consequently, the precise exploitation primitive — whether it is a boolean-based blind, error-based, or UNION-based injection — cannot be confirmed from the available data. It is also not stated whether the injection occurs in a SELECT authentication query or elsewhere in the login flow.

Because this is a first-party application distributed by code-projects (a repository of academic/student projects), it is typically deployed by institutions or individuals who download and host the code directly. There is no centralized update mechanism, which increases the persistence of the vulnerability once deployed.

What is definitively known:

• Attack vector: network (AV:N)
• Attack complexity: low (AC:L)
• Privileges required: none (PR:N)
• User interaction: none (UI:N)
• Scope: unchanged (S:U)
• Confidentiality/Integrity/Availability impact: low/low/low (C:L/I:L/A:L)

The published CVSS 3.1 base score of 7.3 reflects a readily exploitable vulnerability with partial impact across all three security objectives. The EPSS score of 0.00387 (30.5th percentile) indicates that while exploit code is public, observed exploitation activity in the wild remains relatively low at the time of this assessment.

Exploitation Scenarios

The following attack chain is derived strictly from the NVD description and CNA title. No specific function names, query strings, or payloads are provided in the source data, so the scenario is described at the vulnerability-class level.

1. Reconnaissance / Target Identification The attacker identifies internet-exposed instances of College Notes Uploading System 1.0. Discovery can be performed via Shodan, Google dorking, or by probing for the /login.php endpoint. Because the product is a downloadable project, installations are likely hosted on institutional or personal web servers with predictable directory structures. The presence of /login.php combined with the application's title or known static assets supports fingerprinting.

2. Triggering the Flaw (SQL Injection via User Argument) The attacker submits a crafted HTTP request to /login.php in which the User parameter contains SQL syntax. The application incorporates this value into a backend SQL query without adequate neutralization (CWE-74). This allows the attacker to alter the logic of the query — for example, to make an authentication condition always evaluate true or to cause the database to return unintended records.

3. Payload / Execution Method (class-level) As a SQL injection flaw, the attack involves injecting SQL control characters and operators into the User field. Depending on how the application renders errors and query results, the attacker may use:

   • Authentication bypass: injecting a condition that forces the login predicate to return a valid row, granting access without valid credentials.
   • Data extraction: using UNION-based or boolean/error-based techniques to retrieve contents of database tables (e.g., user credentials, note records).
   • Blind inference: where output is not directly reflected, using time-based or boolean responses to infer data. The source advisory does not specify which technique is effective, so the attacker would typically begin with simple tautology tests and escalate based on application responses.

4. Post-Exploitation Impact Successful exploitation can yield unauthorized access to the application's authenticated area and/or the underlying database. This may expose stored user credentials and uploaded note content (confidentiality), permit modification or deletion of records (integrity), and enable denial-of-service conditions if destructive SQL is executed (availability). Because the application handles file uploads in its normal function, an authenticated foothold could also be leveraged for further abuse of the upload functionality, though such escalation is not documented in the CVE data and remains speculative.

Note: No public exploit code was confirmed in the tracked sources (Exploit Code: NO), although the advisory states that an exploit has been made publicly available. The attack chain above is inferred from the vulnerability class and the explicitly stated affected endpoint and parameter.

Impact Assessment

CVSS breakdown (as provided): Base score 7.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.

• Network exploitable (AV:N): The flaw is reachable over the network through the web interface.
• Low complexity (AC:L): No specialized conditions or race windows are required; exploitation is straightforward.
• No privileges (PR:N) / No interaction (UI:N): An unauthenticated attacker can attempt exploitation against any reachable instance without a valid account.
• Partial impact (C:L/I:L/A:L): Confidentiality, integrity, and availability are each assessed as low impact, consistent with a targeted injection that may not result in full database compromise or total service loss.

Blast radius: Any organization hosting College Notes Uploading System 1.0 with /login.php exposed to untrusted networks is at risk. Because this is a downloadable project without a vendor patch pipeline, exposure is determined entirely by individual deployments. Educational institutions and student-run servers are the most likely affected population. Downstream, a successful injection could compromise stored credentials, enabling lateral movement to other services if credentials are reused.

Business impact: Beyond direct data exposure, a compromised educational notes system may violate data protection obligations if it stores personal data of students or staff. Reputational damage and regulatory notification costs are plausible consequences. The lack of an official patch means remediation depends on operator-side action.

Detection Guidance

Sigma Rule

title: SQL Injection Attempt Against College Notes Uploading System login.php
id: 9b3f6a1e-1519-8c2d-0000-0000cve15198
status: experimental
description: Detects SQL injection patterns in HTTP requests targeting /login.php User parameter
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-15198
author: Threat Intelligence Team
date: 2025/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_uri:
    cs-uri-stem|endswith: '/login.php'
  selection_method:
    cs-method: 'POST'
  selection_payload:
    cs-uri-query|contains:
      - "' or "
      - "' OR "
      - "UNION SELECT"
      - "union select"
      - "'--"
      - "'#"
      - "1=1"
      - "1 = 1"
      - "sleep("
      - "SLEEP("
      - "benchmark("
      - "WAITFOR DELAY"
  condition: selection_uri and selection_method and selection_payload
falsepositives:
  - Legitimate input containing apostrophes or the literal string '1=1'
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2025.15198

YARA Rule

rule CVE_2025_15198_SQLi_Login_Payload
{
    meta:
        description = "Detects SQL injection payloads targeting College Notes Uploading System login.php User parameter"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-15198"
        author = "Threat Intelligence Team"
        date = "2025-01-01"
        cve = "CVE-2025-15198"

    strings:
        $login = "login.php" nocase ascii wide
        $user_param = "User=" nocase ascii wide
        $sqli1 = "' OR " nocase ascii wide
        $sqli2 = "'or " nocase ascii wide
        $sqli3 = "UNION SELECT" nocase ascii wide
        $sqli4 = "'--" ascii wide
        $sqli5 = "1=1" ascii wide
        $sqli6 = "SLEEP(" nocase ascii wide

    condition:
        $login and $user_param and 1 of ($sqli*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2025-15198 SQL Injection Attempt Against College Notes Uploading System login.php (User parameter)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/login.php"; http.request_body; content:"User="; nocase; pcre:"/User=[^&]*(%27|')(\\s)*(or|OR|OR%20)[^&]*(=|%3D)/Ri"; reference:cve,2025-15198; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2025-15198; classtype:web-application-attack; sid:202515198; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and http.request.method == "POST" and url.path == "/login.php" ]
  [ network where network.protocol == "http"
      and http.request.method == "POST"
      and url.path == "/login.php"
      and (
        http.request.body.content : ("' OR" or "'or" or "UNION SELECT" or "1=1" or "'--" or "SLEEP(" or "WAITFOR DELAY")
      )
  ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=nginx:access OR sourcetype=stream:http
| search uri_path="/login.php" (method=POST OR http_method=POST)
| eval payload_raw = coalesce(form_data, http_request_body, cs_uri_query)
| where match(lower(payload_raw), "(%27|')[\s]*or|union[\s%0-9a-f+]+select|1[\s]*=[\s]*1|sleep[\s(]|benchmark[\s(]|waitfor[\s%0-9a-f+]+delay|--|%23")
| stats count min(_time) as first_seen max(_time) as last_seen values(payload_raw) as payloads by src_ip, uri_path, http_user_agent
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve_2025_15198,">
  <rule id="202515198" level="12">
    <if_sid>31100,31101,31103,31104,31108</if_sid>
    <field name="url">/login.php</field>
    <regex type="pcre2">(?i)(User=[^&\s]*(%27|')\s*or)|(union\s+select)|(1\s*=\s*1)|(sleep\s*\()|(waitfor\s+delay)</regex>
    <description>CVE-2025-15198 - SQL injection attempt against College Notes Uploading System login.php via User parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sql_injection,web_attack,cve_2025_15198,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, version release, or fix commit was identified for CVE-2025-15198. The maintainer of code-projects College Notes Uploading System has not published a corrective update in any tracked source.

1. Immediate Mitigations

• Restrict exposure: Place the application behind authentication at the network edge (VPN, reverse proxy with basic auth) and restrict access to trusted internal networks. Remove any internet-facing deployment of version 1.0.
• WAF deployment: Configure a Web Application Firewall with SQL injection signatures and specifically inspect the User parameter on POST requests to /login.php. This is a compensating control only and does not fix the underlying flaw.
• Input validation at the proxy: Where feasible, reject requests containing SQL metacharacters in the User field before they reach the application.
• Credential hygiene: Because the injection affects the login flow, rotate any credentials stored or processed by the application and audit database contents for tampering or exfiltration.

2. Patch / Upgrade Steps

• No patched release is available. Operators must monitor the code-projects distribution channel and any future CVE updates for a corrected version.
• If source code is accessible, remediate directly by converting the vulnerable query to use parameterized statements (prepared statements) and binding the User value as a parameter rather than concatenating it into the SQL string. Independently of vendor action, code review of /login.php query construction is advised.

3. Long-Term Hardening

• Eliminate the vulnerable deployment entirely if the application is no longer actively maintained; migrate note-uploading functionality to a supported platform.
• Adopt secure coding standards that enforce parameterized queries for all database access.
• Deploy runtime application self-protection (RASP) or database activity monitoring to detect anomalous query structures.
• Establish a routine for tracking CVEs affecting all third-party and open-source components in use, including downloadable student projects.
• Apply least-privilege database accounts to the web application so that a successful injection has limited reach.

References

1. NVD — CVE-2025-15198: https://nvd.nist.gov/vuln/detail/CVE-2025-15198
2. CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection): https://cwe.mitre.org/data/definitions/74.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. CISA Known Exploited Vulnerabilities Catalog (check for addition): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. code-projects project distribution (reference for affected product): https://code-projects.org/

Exploit-in-the-wild status: Public exploit code is reported by the CNA. EPSS is 0.00387 (30.5th percentile), and CISA KEV status is NO at the time of this assessment. No named threat actor campaign has been associated with this CVE in the provided data.