CVE-2025-3589 is a medium severity (CVSS 6.3) SQL injection in SourceCodester Music Class Enrollment System 1.0, in manage_class.php through the ID argument. No fixed version is listed, so limit access and plan a replacement.
What's affected
The record names the Music Class Enrollment System 1.0 from SourceCodester. The affected file is /manage_class.php, and the manipulated argument is ID. The record says the attack can be launched remotely.
It also says the exploit has been disclosed to the public and may be used. A GitHub write-up is among the references. The record does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
No patched version is named anywhere in the record. SourceCodester projects are typically sample applications offered as free downloads, so a maintained upstream release may not exist. Check the site before assuming otherwise.
How to check if you're exposed
- Search your web servers for the application, in particular for a file named manage_class.php.
- Confirm that the version is 1.0, the only one named in the record.
- Find out whether the application is reachable from the internet, or only from an internal network.
- Review access logs for requests to manage_class.php with unusual ID values.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on your project, and check the Gold directory for the CVE.
What to do now
- Decide whether the application is still needed. Sample and learning projects often end up in production by accident.
- If you keep it, take it off the public internet, or require a login and an IP allow list at the web server.
- Edit the code so database calls use prepared statements, and cast the ID to an integer before use.
- Run the application with a database account that has only the rights it needs.
- Back up the data and review the database for unexpected changes.
- Plan a move to a maintained system for class enrollment.
Why it matters
This is CWE-89, SQL injection, under CWE-74, injection. A request value is placed in a query without being kept apart from the query itself, so the caller can alter the query.
Enrollment systems hold names and contact details of students, sometimes minors. Even with a medium score, a leak of such records matters to the organisation that runs it.
Free downloadable code is a recurring source of this class of issue. It is easy to deploy, rarely reviewed, and has no support channel when a flaw is found. Knowing where such code runs in your estate is the first step.
Quick check
Is there an official patch for the Music Class Enrollment System?
None is named in the record. Treat it as unpatched, and fix the query code yourself or retire the application.
What is the simplest code fix for this class of bug?
Use prepared statements for every query, and validate that an ID is a number before it is used.
Sources
Last reviewed: 18 October 2026.
