Simple Banking System
CVE-2025-11359
LOW
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in code-projects Simple Banking System 1.0. The affected element is an unknown function of the file /transfermoney.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
AnalysisAI
SQL injection in Simple Banking System 1.0 via the ID parameter in /transfermoney.php allows authenticated remote attackers to execute arbitrary SQL queries with low impact on confidentiality, integrity, and availability. The vulnerability requires login credentials (PR:L) and exploitation probability is low (EPSS 0.03%), but publicly available exploit code exists and disclosure has occurred.
Technical ContextAI
Simple Banking System 1.0 contains a SQL injection vulnerability classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), indicating inadequate input sanitization or parameterized query usage in the /transfermoney.php endpoint. The ID parameter is passed directly into SQL queries without proper escaping or prepared statement protection. This is a server-side web application vulnerability in a PHP-based banking application, affecting the money transfer functionality which typically handles sensitive financial transactions.
RemediationAI
Apply an input validation and parameterized query fix to /transfermoney.php by using prepared statements with bound parameters instead of string concatenation for all SQL queries, particularly the ID parameter. Contact CodeAstro at code-projects.org or check their official channels for a patched version; if no official patch is available, implement a temporary compensating control by restricting /transfermoney.php access via Web Application Firewall (WAF) rules that block requests with suspicious SQL metacharacters (semicolons, quotes, UNION, SELECT) in the ID parameter, and disable unnecessary database user privileges in the application's database account to enforce least privilege. Monitor the GitHub issue at https://github.com/ceeeeb-hao/cve/issues/1 for patch announcements.
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Share
External POC / Exploit Code
Leaving vuln.today