E-Banking System CVE-2025-11608
MEDIUMSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N, AC:L, PR:N, UI:N; low impacts on all CIA.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in code-projects E-Banking System 1.0. This affects an unknown function of the file /register.php of the component POST Parameter Handler. The manipulation of the argument username/password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
AnalysisAI
SQL injection in code-projects E-Banking System 1.0 allows unauthenticated remote attackers to manipulate database queries via the username and password parameters in the registration form. Publicly available exploit code exists, but no active exploitation has been confirmed and the EPSS score is very low (0.03%), indicating limited real-world risk despite the ease of exploit.
Technical ContextAI
The vulnerability is a classic SQL injection (CWE-74) in a PHP-based web application that handles user registration. The registration endpoint (/register.php) directly concatenates user-supplied input into SQL queries without proper sanitization or parameterization, allowing an attacker to inject arbitrary SQL commands. The CPE cpe:2.3:a:fabian:simple_e-banking_system:1.0 identifies the exact affected product and version.
RemediationAI
No official patch has been released by the vendor. The primary remediation is to implement proper input validation and parameterized queries (prepared statements) in the /register.php script for the username and password fields. As a workaround, deploy a web application firewall (WAF) with rules to block SQL injection patterns, or restrict network access to the registration endpoint if not needed. Note that a WAF may be bypassed and does not fix the underlying code flaw.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today