CVE-2025-65135 - Vulnerability Analysis

Overview

manikandan580 School-management-system 1.0 contains a time-based blind SQL injection caused by unsanitized fromdate POST parameter in /studentms/admin/between-date-reprtsdetails.php, letting attackers extract data via time delays, exploit requires crafted POST request.

Severity & Score

Impact

Attackers can extract sensitive database information remotely via time delays, potentially compromising data confidentiality.

Mitigation

Update to the latest version or apply patches to sanitize input in fromdate parameter.

References

• https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2025-65135
• https://github.com/TREXNEGRO/Security-Advisories/blob/main/CVE-2025-65135/poc.md

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner