Simple Banking System
CVE-2025-11357
LOW
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
A security flaw has been discovered in code-projects Simple Banking System 1.0. This issue affects some unknown processing of the file /createuser.php. Performing manipulation of the argument Name results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.
AnalysisAI
SQL injection in Simple Banking System 1.0 allows authenticated remote attackers to manipulate the Name parameter in /createuser.php and execute arbitrary SQL queries, resulting in limited impact to confidentiality, integrity, and availability. The vulnerability has a low CVSS score of 2.1 due to requirement for prior authentication (PR:L) and limited scope of impact, but publicly available exploit code exists and the EPSS score of 0.03% suggests minimal real-world exploitation probability despite public POC availability.
Technical ContextAI
The vulnerability exists in PHP-based web application code where user input from the Name parameter in /createuser.php is improperly validated before being incorporated into SQL queries. This is a classic CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) issue stemming from inadequate input sanitization or parameterized query implementation. The flaw allows SQL injection (SQLi) attacks through unsanitized concatenation of user-supplied data directly into SQL commands. The affected product is code-astro's Simple Banking System version 1.0, as identified by CPE cpe:2.3:a:codeastro:simple_banking_system:1.0:*:*:*:*:*:*:*.
RemediationAI
Immediate action should focus on input validation and parameterized queries: upgrade or patch Simple Banking System if a patched version is available from code-astro, or implement immediate compensating controls by validating the Name parameter against a strict whitelist (alphanumeric and allowed special characters only) before it reaches database logic, and refactor the /createuser.php file to use prepared statements with parameterized queries instead of string concatenation for all SQL operations. If immediate patching is not possible, implement database-level restrictions by creating a dedicated low-privilege database user for the application with only INSERT and SELECT permissions on necessary tables, preventing unauthorized data modification or exfiltration. Additionally, enforce strict authentication controls and restrict access to /createuser.php to authorized administrators only via IP whitelisting or role-based access controls. Monitor database activity for suspicious SQL patterns in query logs. Verify fixes with vendor documentation at https://code-projects.org/ and test patches in non-production environments before deployment. The trade-off of database privilege restriction is reduced application functionality if the system requires broader operations, requiring careful review of legitimate application needs.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today