Which versions of Best Salon Management System are affected by CVE-2025-6580?

A publicly disclosed SQL injection vulnerability in the Best Salon Management System 1.0 login function allows unauthenticated attackers to bypass authentication and access sensitive customer and…

Is there a public PoC exploit available for CVE-2025-6580?

Yes, a public proof-of-concept exploit is available for CVE-2025-6580. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6580?

Within 24 hours: Isolate affected systems from production networks or restrict login access to trusted IP ranges only. Within 7 days: Deploy WAF rules to block SQL injection patterns in the username parameter, implement database query parameterization if accessible, and conduct an audit for evidence of exploitation. Within 30 days: Evaluate migration to an alternative, supported salon management system or apply vendor patch immediately upon release.

Best Salon Management System CVE-2025-6580

Q: What is the CVSS score of CVE-2025-6580?

CVE-2025-6580 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-19075 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-24 cna@vuldb.com

SQLi Best Salon Management System Mayurik

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 22:36 euvd

EUVD-2025-19075

Analysis Generated

Mar 15, 2026 - 22:36 vuln.today

PoC Detected

Jul 02, 2025 - 17:13 vuln.today

Public exploit code

CVE Published

Jun 24, 2025 - 22:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability classified as critical has been found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the component Login. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6580 is a critical SQL injection vulnerability in SourceCodester Best Salon Management System 1.0 affecting the Login component's Username parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing exploitation risk.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-74: Improper Neutralization of Special Elements used in an SQL Command) in the authentication/login mechanism. The vulnerability exists in the Username input parameter of the Login component, which fails to properly sanitize or parameterize user input before incorporating it into SQL queries. SourceCodester Best Salon Management System 1.0 appears to be a PHP-based web application for salon business management. The root cause is insufficient input validation and the likely absence of prepared statements or parameterized queries in the authentication logic. Attackers can inject malicious SQL syntax (e.g., ' OR '1'='1) to bypass authentication, extract sensitive data from the database, or modify records. CWE-74 specifically covers improper neutralization of special elements in SQL commands, which is the direct cause here.

RemediationAI

Immediate actions: (1) Upgrade SourceCodester Best Salon Management System to the latest patched version if available; contact vendor SourceCodester for security updates; (2) If patching is unavailable, implement input validation/WAF rules to block SQL injection attempts in the Login Username parameter (block single quotes, SQL keywords, comment sequences); (3) Implement prepared statements and parameterized queries in all database interactions, particularly authentication code; (4) Apply principle of least privilege to database user accounts; (5) Enable SQL query logging and monitoring; (6) Disable or restrict direct database access from the web application. Temporary mitigation: Deploy Web Application Firewall (WAF) rules to sanitize SQL injection payloads until patching is possible. Code-level fix: Replace string concatenation in SQL queries with prepared statements (parameterized queries) using the application's database library.