CVE-2025-22925

High

Published: 02 April 2025

Published

02 April 2025

Modified

29 April 2025

KEV Added

—

Patch

—

CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0124 79.6th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22925 is a high-severity SQL Injection (CWE-89) vulnerability in Os4Ed Opensis. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

OS4ED openSIS versions 7.0 through 9.1 contain a SQL injection vulnerability (CWE-89) in the table parameter of the /attendance/AttendanceCodes.php endpoint. The flaw allows crafted input to be passed directly into database queries without proper sanitization or parameterization.

A remote attacker who is already authenticated with the admin role can supply malicious values to the affected parameter. Successful exploitation can alter query logic, potentially leading to high-impact effects on availability such as database errors or service disruption, consistent with the reported CVSS 7.5 vector that emphasizes network-accessible attack with no user interaction required.

Public references consist of the openSIS-Classic repository and a third-party vulnerability-research repository that documents the issue; no official vendor advisory or patch information is provided in the available sources. The associated EPSS score remains low, moving only from 0.0124 to a peak of 0.0133 with no material upward trajectory after disclosure.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-14955

Vulnerability details

OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the table parameter at /attendance/AttendanceCodes.php. The remote, authenticated attacker requires the admin role to successfully exploit this vulnerability.