CVE-2025-10477 is a medium severity SQL injection flaw (CVSS 6.3) in kidaze CourseSelectionSystem. The Branch parameter of /Profilers/PriProfile/eligibility.php is not safely handled. The record names no fixed version, so restrict access, patch the query code yourself, and scan your dependencies.
What's affected
The record lists kidaze CourseSelectionSystem up to commit 42cd892b40a18d50bd4ed1905fa89f939173a464. It also notes that the product does not use versioning, so the record cannot say which releases are affected or unaffected. In practice, any copy built from that commit or earlier should be treated as exposed.
No fixed version appears in the record. I could not confirm a patched release from the sources available, so check the kidaze site and the referenced report before assuming a fix exists. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which means network reachable, low complexity, no user interaction, and low privileges required, typically a logged in account.
How to check if you're exposed
Start by confirming the application is deployed and the file exists. Then check how the Branch value reaches the database.
find /var/www -name "eligibility.php" 2>/dev/null
grep -rn "Branch" $(find /var/www -name "eligibility.php")
If the value is concatenated into a query string instead of passed as a bound parameter, the code is vulnerable. Then check web server access logs for requests to this path that carry quotes, SQL keywords or unusually long values.
You can also paste your dependency manifest into the free in-browser scan at gold.safeguard.sh/scan. It will not find an application like this one if you installed it as a standalone folder, so inventory it by hand.
What to do now
- Take
/Profilers/PriProfile/eligibility.phpoffline or restrict it by network address or authentication until it is fixed. - Rewrite the query to use prepared statements with bound parameters for
Branch. - Run the database account for this application with the least privileges it needs.
- Put a web application firewall rule in front of the endpoint as a stopgap, knowing it is not a fix.
- Review logs and database contents for signs of misuse, and rotate any credentials stored in the affected database.
- Decide whether this software should be in production at all if the maintainer does not ship fixes.
Why it matters
This is CWE-89 within the broader injection class CWE-74. The application builds a database query from text the user supplies, and the database cannot tell the developer's query from the attacker's additions. The result can be reading, changing or deleting data, which fits the low confidentiality, integrity and availability impact in the vector.
The fix pattern is old and well known: parameterized queries. The harder question for small web applications is who will apply it. Because this endpoint needs a logged in account (PR:L in the vector), the practical risk depends on who can obtain one. The record does not flag this CVE as a CISA Known Exploited Vulnerability, so there is no confirmation here that it is exploited in the wild.
The record also says the exploit has been disclosed to the public. That is a statement about published details, not a confirmation of attacks, so treat the timeline as short without assuming a breach.
Quick check
Is there a fixed version of CourseSelectionSystem?
The record lists none. Check the kidaze site and the referenced report. Until then, restrict the endpoint and fix the code yourself.
Is this being exploited in the wild?
The record does not flag it as a CISA KEV entry. It does say the exploit has been published, so assume attackers can reproduce it.
Sources
- Safeguard Gold entry for CVE-2025-10477
- NVD record for the CVE, as supplied in the Safeguard CVE feed
- The links below come from that record. Several could not be opened when this post was reviewed, so confirm details with the vendor.
- https://github.com/Miker132/CVE-/issues/6
- https://vuldb.com/?ctiid.323913
- https://vuldb.com/?id.323913
- https://vuldb.com/?submit.648516
Last reviewed: 19 October 2026.
