Security readout for executives and security teams
Plain-English summary
This flaw may let an unauthenticated remote attacker manipulate the enrollment system’s database through a class-name input. Successful exploitation could expose, alter, or delete sensitive records and disrupt enrollment operations. The supplied evidence identifies version 1.0, but provides no confirmed patch or vendor remediation.
Executive priority
Treat confirmed reachable deployments as an immediate remediation priority because the stated impact covers data theft, unauthorized modification, and service disruption. Isolate exposed instances while technical teams confirm the vulnerable code path and seek official guidance. Do not infer compromise solely from vulnerability presence.
Technical view
CVE-2025-67403 is a CWE-89 SQL injection in CASAP Automated Enrollment System 1.0. The vulnerable input is the class_name parameter handled by update_class.php. Its CVSS 3.1 score is 9.8, reflecting network access, low complexity, no required privileges or interaction, and potentially high confidentiality, integrity, and availability impact.
Likely exposure
Prioritize systems running CASAP Automated Enrollment System 1.0 where update_class.php is network-reachable. Internet exposure increases urgency. The structured affected-product metadata is incomplete, listing vendor and product as “n/a,” so confirm deployments by application name, version, files, and ownership rather than relying only on CPE-based scanning.
Exploitation context
The supplied bundle does not establish active exploitation, and its KEV indicator is false. The CVSS vector indicates potentially unauthenticated remote exploitation with low complexity, but no exploit prevalence, observed attacks, or reliable exploitation telemetry is provided. Treat reachability as significant risk without claiming compromise.
Researcher notes
The primary technical claim is narrowly defined: SQL injection through class_name in update_class.php. Confidence is limited by incomplete affected-product metadata, one linked technical report, and absent patch and exploitation evidence. Validate authentication, routing, query construction, database privileges, and logging locally without assuming every deployment is identically configured.
Mitigation direction
- Identify and prioritize all deployments of CASAP Automated Enrollment System 1.0.
- Check project or vendor guidance for an official patch or supported remediation.
- Temporarily restrict update_class.php to trusted networks or authenticated administrative users.
- Ask maintainers to review class_name database handling and implement appropriate SQL-injection protections.
- Back up the database and verify recovery procedures before applying application changes.
Validation and detection
- Confirm the installed application identity and version using deployment records and file metadata.
- Determine whether update_class.php is reachable from untrusted networks without authentication.
- Review application code to confirm whether class_name reaches a dynamically constructed SQL query.
- Inspect web and database logs for unusual requests involving update_class.php or class_name.
- After remediation, perform authorized regression testing without using production data.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-67403 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.