What is the CVSS score of CVE-2025-69946?

CVE-2025-69946 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Modern Loan Management System are affected by CVE-2025-69946?

Modern Loan Management System 1.0 contains a critical unauthenticated SQL injection vulnerability (CVSS 9.8) that allows remote attackers to compromise the entire loan database without credentials.

How to fix or mitigate CVE-2025-69946?

Within 24 hours: Isolate affected Modern Loan Management System 1.0 instances from internet-accessible networks if operationally feasible, identify all deployed instances, and notify security and database teams. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection attempts targeting the vulnerable ajaxData.php parameters (district_id, division_id, region_id, ward_id), enable comprehensive database activity monitoring and alerting for anomalous SQL patterns, and audit recent database access logs for signs of exploitation. Within 30 days: Escalate to SourceCodester for patch availability and timeline, evaluate migration to an actively maintained alternative loan management system, and implement additional input validation and SQL parameterized queries as an interim defense.

Modern Loan Management System CVE-2025-69946

EUVD-2025-210576 CRITICAL

SQL Injection (CWE-89)

2026-07-31 cve@mitre.org

GHSA-9c5g-r8mq-82p6

PHP SQLi

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable AJAX endpoint with direct SQL injection gives full database read/write, so PR:N, UI:N, AC:L and C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 19:38 vuln.today

CVSS changed

Aug 03, 2026 - 17:37 NVD

9.8 (CRITICAL)

CVE Published

Jul 31, 2026 - 21:17 cve.org

CRITICAL 9.8

CVE Published

Jul 31, 2026 - 21:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters district_id , division_id, region_id, and ward_id.

AnalysisAI

SQL injection in SourceCodester Modern Loan Management System 1.0 allows remote attackers to inject arbitrary SQL through the district_id, division_id, region_id, and ward_id parameters of ajaxData.php. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, exploitation requires no authentication or user interaction and yields total compromise of the backend database (confidentiality, integrity, and availability all High). Publicly available exploit code exists (documented in the TaintRadar research repository), though EPSS remains low at 0.16% and the flaw is not on the CISA KEV list.

Technical ContextAI

The affected component is a PHP web application (tagged PHP, SQLi) that exposes an AJAX data endpoint, ajaxData.php, used to populate cascading location dropdowns (district/division/region/ward). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the four location identifier parameters are concatenated directly into SQL queries against the MySQL/MariaDB backend without parameterization or input sanitization. SourceCodester Modern Loan Management System is a small open-source PHP/MySQL loan-management web application, so the injection point sits directly in front of the application's primary datastore, which typically holds borrower PII and loan records. A separate related sink (delete_group.php via the id parameter) is documented in the same research repository, indicating a systemic lack of prepared statements across the codebase.

RemediationAI

No vendor-released patch identified at time of analysis; SourceCodester scripts are typically distributed as source without formal patch releases. The definitive fix is to rewrite the ajaxData.php queries to use parameterized prepared statements (PDO or mysqli bound parameters) for district_id, division_id, region_id, and ward_id, and to cast these identifiers to integers before use since they are numeric location keys - apply the same remediation to the related delete_group.php id sink. Until code is fixed, apply specific compensating controls: place the application behind a WAF with SQLi signatures targeting the ajaxData.php parameters (trade-off: pattern-based bypass remains possible); restrict network access to ajaxData.php to authenticated internal users via web-server ACLs or authentication middleware (trade-off: may break the location-dropdown feature for legitimate anonymous flows); and enforce least-privilege on the database account so the web user cannot read unrelated tables or write (trade-off: none significant, recommended regardless). Validate all input against a strict numeric allowlist at the reverse proxy as a stopgap. Consult the NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-69946) and VulDB (https://vuldb.com/vuln/385144) entries for updates.