Best Salon Management System CVE-2025-6580

This vulnerability presents significant real-world risk. The CVSS 3.1 score of 7.3 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L indicates: (1) Network-accessible attack vector (AV:N) requiring no special network access; (2) Low attack complexity (AC:L) - straightforward exploitation; (3) No privilege requirements (PR:N) - unauthenticated access; (4) No user interaction needed (UI:N); (5) Confidentiality, Integrity, and Availability all partially impacted. The public disclosure with available POC significantly elevates exploitation probability. The CVSS score underrates the actual risk because SQL injection in authentication components typically allows complete bypass and database compromise, which would warrant a 9.0+ score in practice. However, the disclosed POC and network accessibility make this actively exploitable. Without KEV or EPSS data explicitly provided, the combination of public POC + authentication bypass + remote accessibility suggests this should be treated as critical priority. Organizations running version 1.0 face imminent exploitation risk.

An attacker identifies the SourceCodester Best Salon Management System login page. They submit a crafted Username parameter containing SQL injection payload such as: ' OR '1'='1' -- or admin' -- which, when processed by vulnerable code like SELECT * FROM users WHERE username='[INPUT]' AND password='[PASSWORD]', executes as SELECT * FROM users WHERE username='' OR '1'='1'-- AND password='...' thereby bypassing authentication and logging in as the first database user (often an administrator). Once authenticated, the attacker gains access to sensitive salon client data, employee information, appointment records, and payment details. They could further exploit database access to extract credentials, modify business records, or insert malicious data. Given the public POC availability and low attack complexity, this scenario is highly probable within hours of CVE publication for unpatched systems.