Best Salon Management System
CVE-2025-12325
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Password reset endpoint is unauthenticated and network-accessible (AV:N, PR:N); SQLi enables partial data read/write (C:L, I:L); no availability impact expected from a single-parameter injection on a non-destructive endpoint.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/forgot-password.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
SQL injection in SourceCodester Best Salon Management System 1.0 exposes unauthenticated remote attackers to database manipulation via the email parameter in the /panel/forgot-password.php password recovery endpoint. A public proof-of-concept exploit has been disclosed, though EPSS at 0.03% (8th percentile) and absence from CISA KEV indicate very low observed real-world exploitation. Impact is partial across confidentiality, integrity, and availability per the CVSS 4.0 scoring, consistent with a restricted database account context rather than full system compromise.
Technical ContextAI
The affected product is SourceCodester Best Salon Management System version 1.0, a PHP-based web application developed by mayurik (CPE: cpe:2.3:a:mayurik:best_salon_management_system:1.0:*:*:*:*:*:*:*). The vulnerability exists in the unauthenticated password recovery endpoint /panel/forgot-password.php, where the email POST parameter is concatenated into a backend SQL query without sanitization or use of prepared statements. The assigned CWE-74 covers the broader Injection category; the specific subtype is SQL injection (CWE-89 subset), wherein attacker-controlled input is interpreted as SQL syntax by the database engine. This class of flaw is a direct consequence of trusting user-supplied data in query construction - a well-understood PHP antipattern remediated via PDO prepared statements or MySQLi parameterized queries.
RemediationAI
No vendor-released patch has been identified at the time of analysis for Best Salon Management System 1.0. The primary fix requires a code-level change in /panel/forgot-password.php: replace raw query string concatenation with PDO or MySQLi prepared statements for the email parameter, which eliminates the injection surface with no functional trade-off. As a compensating control, administrators should deploy WAF rules targeting SQL injection patterns on the /panel/forgot-password.php endpoint - note that WAF rules may introduce false positives for edge-case email formats. Restricting network access to the /panel/ directory via server-level access controls (e.g., nginx allow/deny directives or .htaccess IP allowlisting) reduces exposure but will prevent legitimate remote users from accessing the password reset feature. Additional context is available at https://vuldb.com/?ctiid.330102 and https://vuldb.com/?id.330102.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today