Society Management System
CVE-2025-15353
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin path implies high-privilege requirement; SQL injection yields full DB read/write, justifying C:H and I:H despite conservative reported impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in itsourcecode Society Management System 1.0. Impacted is the function edit_admin_query of the file /admin/edit_admin_query.php. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
AnalysisAI
SQL injection in itsourcecode Society Management System 1.0 allows remote attackers to manipulate database queries via the Username parameter in the edit_admin_query function at /admin/edit_admin_query.php. The affected product is a free PHP-based web application distributed by itsourcecode.com, pinned at version 1.0 with no patch released. Publicly available exploit code exists per the GitHub PoC reference, though EPSS sits at 0.04% (11th percentile), indicating limited observed exploitation activity in the wild despite disclosure.
Technical ContextAI
The affected product, identified by CPE cpe:2.3:a:angeljudesuarez:society_management_system:1.0:*:*:*:*:*:*:*, is a PHP application for managing society or community membership records. The vulnerability resides in the edit_admin_query() function within /admin/edit_admin_query.php, where the Username argument is passed unsanitized into a SQL query. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection) is the assigned root cause class, encompassing the more specific SQL injection pattern (CWE-89). The lack of parameterized queries or prepared statements in the PHP backend allows an attacker to append or alter SQL logic, potentially reading arbitrary table data, modifying records, or - depending on database permissions - executing stacked queries.
RemediationAI
No vendor-released patch has been identified at the time of analysis; the itsourcecode.com product page does not carry a security advisory. Organizations running Society Management System 1.0 should apply the following compensating controls: first, implement server-side input validation and parameterized (prepared) statements in /admin/edit_admin_query.php to replace raw SQL string concatenation - this is the definitive fix and must be applied manually to the source code. Second, restrict access to the /admin/ directory via web server access controls (e.g., HTTP Basic Auth at the nginx/Apache layer, IP allowlisting) to limit exposure of the admin panel to trusted networks only. Third, apply a WAF rule blocking SQL metacharacters (quotes, semicolons, comment sequences) in the Username parameter as a short-term layer. Note that WAF-only mitigations are bypassable with encoding tricks and should not substitute for code-level fixes. The VulDB entry at https://vuldb.com/?id.338740 and PoC at https://github.com/BUPT2025201/CVE/issues/4 provide additional technical detail for patch authoring.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today