CVE-2025-67408

CVE-2025-67408 is a SQL injection vulnerability in the CASAP automated enrollment system, a PHP application distributed through Sourcecodester. The vulnerability lives in the save_user.php endpoint, specifically through the 'status' parameter. CVSS 7.3 correctly encodes that exploitation could yield database compromise, credential theft, and data exfiltration. But the EPSS score of 0.00169 tells you something the CVSS cannot: automated exploitation is vanishingly unlikely. Here's what matters operationally: the CASAP system is almost certainly deployed at a small number of Philippine educational institutions. This is not enterprise software running in thousands of organizations. It's a niche enrollment system, likely behind internal network segments, administered by staff who may not monitor CVE feeds. The low EPSS reflects this reality—not that the vulnerability is hard to exploit, but that there's almost no target population for automated scanners to find. That said, don't let the low EPSS create false comfort. Student data has a multi-decade exploitation window. Minors' PII stolen today can fuel identity fraud well after this system is forgotten. And while the footprint is small, the blast radius if compromised could be significant—an enrollment system touching credentials and student records is a single compromise away from serving as a credential-harvesting pivot into broader networks. For defenders: first, determine whether you run this software. Check for save_user.php in any CASAP or enrollment-related PHP deployments. Second, verify whether that endpoint requires authentication and what network position it occupies—if it's internet-facing, treat this as higher priority than the EPSS alone would suggest. Third, assume no patch is coming. Sourcecodester projects are frequently abandoned after initial release. Mitigate through WAF rules targeting SQL injection in the status parameter, network segmentation that isolates enrollment systems from sensitive administrative networks, and monitoring for the CVE identifier in your threat intelligence feeds even if you choose not to escalate it internally. The CVSS 7.3 is technically accurate about impact potential. The EPSS 0.00169 is more useful for prioritization. Calibrate your response to actual exposure, not theoretical severity.

Reviewed through automated stages and approved by a human before publication.