CVE-2025-65135
Published: 14 April 2026
Summary
CVE-2025-65135 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-65135 is a time-based blind SQL injection vulnerability in the manikandan580 School-management-system version 1.0. The flaw resides in the /studentms/admin/between-date-reprtsdetails.php endpoint, where the fromdate POST parameter is vulnerable to manipulation, allowing attackers to inject malicious SQL payloads. It has been assigned a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-89 (SQL Injection). The vulnerability was published on 2026-04-14.
Any unauthenticated attacker with network access can exploit this vulnerability due to its low attack complexity and lack of required privileges or user interaction. Successful exploitation enables remote extraction of sensitive data from the database through timing differences in query responses, as well as potential modification or deletion of data, leading to high impacts on confidentiality, integrity, and availability.
Advisories and a proof-of-concept are available in the TREXNEGRO Security-Advisories GitHub repository at https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2025-65135 and https://github.com/TREXNEGRO/Security-Advisories/blob/main/CVE-2025-65135/poc.md, detailing the issue and demonstration of exploitation. No specific patches or mitigation steps are outlined in the provided references.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209446
Vulnerability details
In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin/between-date-reprtsdetails.php through the fromdate POST parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated exploitation of a public-facing web application via SQL injection payload in a POST parameter.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires the system to validate information inputs such as the 'fromdate' POST parameter against expected syntax, semantics, and format to block SQL injection payloads.
Requires timely identification, prioritization, assessment, and remediation of the SQL injection flaw in the /studentms/admin/between-date-reprtsdetails.php endpoint.
Boundary protection mechanisms such as web application firewalls monitor and filter incoming POST requests to block SQL injection attempts on the vulnerable 'fromdate' parameter.