What is the CVSS score of CVE-2025-69947?

CVE-2025-69947 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Tailor Management System are affected by CVE-2025-69947?

SourceCodester Tailor Management System 1.0 contains a critical SQL injection vulnerability (CVE-2025-69947, CVSS 9.8) exploitable without authentication, permitting attackers to extract, modify, or…

How to fix or mitigate CVE-2025-69947?

Within 24 hours, identify all systems running SourceCodester Tailor Management System 1.0 and restrict network access to trusted internal networks only, blocking external inbound connections to the application. Within 7 days, deploy a Web Application Firewall with SQL injection detection rules targeting the customeredit.php endpoint's 'id' parameter, enable database query logging to detect exploitation attempts, and contact SourceCodester for patch status and estimated release date. Within 30 days, obtain and apply a vendor-released patch for CVE-2025-69947 as soon as it becomes available; if SourceCodester provides no patch timeline, plan a complete system replacement with an actively maintained alternative tailor management platform.

Tailor Management System CVE-2025-69947

EUVD-2025-210562 CRITICAL

SQL Injection (CWE-89)

2026-07-30 mitre

GHSA-pqjh-v577-x2q8

PHP SQLi N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable GET-parameter SQLi with no user interaction gives AV:N/AC:L/UI:N and full C/I/A impact; PR:N mirrors the source vector, though the admin edit page may in fact require authentication (potentially PR:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:26 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 30, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jul 30, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.

AnalysisAI

SQL injection in SourceCodester Tailor Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of customeredit.php, per the CVSS:3.1 vector (PR:N) without prior authentication. The flaw carries a critical CVSS 9.8 rating with full confidentiality, integrity, and availability impact, enabling database extraction, tampering, or destruction. There is no public exploit code, but a detailed technical write-up documenting the injection point exists, and the EPSS probability is low (0.14%, 4th percentile), indicating limited real-world exploitation interest despite the high severity.

Technical ContextAI

Tailor Management System is a small PHP/MySQL web application distributed by SourceCodester for managing tailoring shop customer and order records. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the customeredit.php script incorporates the user-supplied 'id' GET parameter directly into a SQL query without parameterization or input validation, allowing an attacker to break out of the query context and inject arbitrary SQL. Because the application uses PHP with a MySQL-style backend (tags: PHP, SQLi), typical exploitation leverages UNION-based or error/boolean/time-based blind techniques against the tailored query. The provided CPE (cpe:2.3:a:n/a:n/a:*) is a placeholder ('n/a') and does not usefully identify the vendor or product, so affected-product identity rests on the description text rather than structured CPE data.

RemediationAI

No vendor-released patch identified at time of analysis; SourceCodester has not published a fixed version in the supplied data. The definitive fix is to rewrite customeredit.php (and any similar scripts) to use parameterized/prepared statements (PDO or mysqli with bound parameters) instead of concatenating the 'id' value into the query, and to cast/validate 'id' as an integer server-side. As compensating controls until code is fixed: restrict access to the admin/edit pages by enforcing session authentication and IP allowlisting on customeredit.php (trade-off: blocks legitimate remote admins not on the allowlist); deploy a WAF rule to block SQL metacharacters on the 'id' parameter (trade-off: signature bypasses are common, so treat as defense-in-depth not a fix); and remove the application from internet exposure entirely if it is a demo/internal tool. Consult the technical write-up (https://github.com/um-dsp/TaintRadar/...customeredit.php-id-sqli.md) to confirm the exact injectable query and validate the fix.