Online Beauty Parlor System CVE-2025-14989
MEDIUMSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable SQL injection with low impact across confidentiality, integrity, and availability.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This issue affects some unknown processing of the file /admin/search-invoices.php. Such manipulation leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
AnalysisAI
SQL injection in Online Beauty Parlor System 1.0 allows remote attackers to manipulate database queries through the /admin/search-invoices.php endpoint. The vulnerability carries a medium CVSS score, but exploit code is publicly available and no authentication is required, making it easy to attack. No active exploitation in the wild has been confirmed, and the EPSS probability remains low.
Technical ContextAI
The flaw resides in a PHP-based web application that processes user-supplied input within a search-invoices script without proper sanitization. This aligns with CWE-74, indicating inadequate neutralization of special elements that can alter SQL syntax. The affected product is captured by CPE cpe:2.3:a:campcodes:complete_online_beauty_parlor_management_system:1.0.
RemediationAI
No official vendor patch has been identified at the time of analysis. Users may apply immediate mitigations: restrict access to /admin/search-invoices.php (e.g., via .htaccess or firewall rules) to trusted IPs only, remove or rename the vulnerable file if not required, or manually add input validation and parameterized queries to the PHP code. Disabling the file entirely will break the search-invoices functionality. Contact the vendor for a fix.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today