# CVE-2025-60307: code-projects Computer Laboratory System SQL injection in login page

Source: https://junglewise.ai/threats/cve-2025-60307-code-projects-computer-laboratory-system-sql-injection-in-login  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-10. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-60307 · Severity: critical · CVSS 9.8 · Published 2025-10-10

The Computer Laboratory System, a management platform for lab environments, contains a security flaw in its login process. An attacker can bypass the password requirement by entering a specially crafted command, gaining full administrative access to the system. This could lead to unauthorized access to lab records, system configuration changes, and complete control over the application.

Technologies: [Carmelo Computer Laboratory System](https://junglewise.ai/threats/technologies/computer-laboratory-system). Vendors: [Carmelo](https://junglewise.ai/threats/vendors/carmelo).

## Quick answers

**Is CVE-2025-60307 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-60307 being exploited in the wild.

**How severe is CVE-2025-60307?** Critical severity, with a CVSS score of 9.8, published 10 October 2025.

**Which products and versions are affected?** code-projects Computer Laboratory System 1.0.

**Is there a fix for CVE-2025-60307?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-60307 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-60307?** Check whether you run Carmelo Computer Laboratory System. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the login component of code-projects Computer Laboratory System 1.0 due to improper neutralization of special elements in the 'Password' input field (CWE-89). An unauthenticated remote attacker can exploit this by submitting a 'universal password' payload (e.g., ' OR 1=1 #) to bypass the authentication logic. Successful exploitation grants the attacker administrative privileges without a valid password. Testing with automated tools like sqlmap confirms that the password parameter is injectable and can be used to extract database information.

## Affected products

- code-projects Computer Laboratory System 1.0

## Timeline

- 2025-10-10: disclosed: Initial CVE publication
- 2025-10-15: advisory: CISA-ADP enrichment and CVSS scoring

## References

- [https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-60307.md](https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-60307.md)

## Related threats

- [A vulnerability has been found in code-projects Computer Laboratory System 1.0. Impacted is an unknown function of the…](https://junglewise.ai/threats/cve-2025-14642-a-vulnerability-has-been-found-in-code-projects-computer)
- [A flaw has been found in code-projects Computer Laboratory System 1.0. This issue affects some unknown processing of…](https://junglewise.ai/threats/cve-2025-14641-a-flaw-has-been-found-in-code-projects-computer-laboratory-system)
- [code-projects Computer Laboratory System unrestricted file upload in avatar settings](https://junglewise.ai/threats/cve-2025-56295-code-projects-computer-laboratory-system-unrestricted-file-upload)