CVE-2025-57515
Published: 06 October 2025
Summary
CVE-2025-57515 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 49.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by validating and sanitizing vulnerable input fields before they are used in database queries.
Requires timely remediation of the specific SQL injection flaw in Uniclare Student Portal v2 to eliminate the vulnerability.
Enables monitoring of system and database activities to identify exploitation attempts via time-delay functions or anomalous queries.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
T1190 directly matches exploitation of a public-facing web application via unauthenticated SQL injection. T1213.006 is facilitated by the ability to inject SQL for extracting sensitive database information.
NVD Description
A SQL injection vulnerability has been identified in Uniclare Student Portal v2. This flaw allows remote attackers to inject arbitrary SQL commands via vulnerable input fields, enabling the execution of time-delay functions to infer database responses.
Deeper analysisAI
CVE-2025-57515 is a SQL injection vulnerability (CWE-89) affecting Uniclare Student Portal v2, published on 2025-10-06T18:15:51.663. The flaw enables remote attackers to inject arbitrary SQL commands through vulnerable input fields, particularly by executing time-delay functions to infer database responses.
Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation allows high-impact compromise of confidentiality, integrity, and availability, such as through time-based blind SQL injection to extract sensitive data or manipulate database operations.
Advisories and additional details, including potential mitigation steps, are documented in the referenced sources: the GitHub repository at https://github.com/sanchitsahni/CVE-2025-57515/ and the PDF report at https://github.com/sanchitsahni/CVE-2025-57515/blob/main/Uniclare%20Student%20Portal%20v2.pdf.
Details
- CWE(s)