EUVD-2025-210575
GHSA-9cpp-crjx-w8h3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable, low-complexity SQLi with full DB read/write/delete impact; PR:L rather than PR:N because the sink is an /admin endpoint that should require authentication.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1.
AnalysisAI
SQL injection in SourceCodester Modern Loan Management System 1.0 lets attackers manipulate the database via the unsanitized 'id' parameter of /admin/delete_group.php. The flaw carries a CVSS 9.8 and CISA SSVC rates technical impact as total and automatable, but EPSS is only 0.16% (5th percentile) and status is publicly available exploit code exists (POC), not active exploitation. A TaintRadar proof-of-concept is published, making trivial exploitation likely against any exposed instance.
Technical ContextAI
The application is a PHP/MySQL web application distributed by SourceCodester as a small business/tutorial-grade loan management product. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the 'id' GET parameter passed to /admin/delete_group.php is concatenated directly into a SQL query - most likely a DELETE (and possibly SELECT) statement operating on loan/borrower group records - without parameterization or input validation. Because the sink is a delete-oriented endpoint, both in-band (UNION/error-based) and blind boolean/time-based extraction are plausible, and stacked queries may be possible depending on the MySQL driver configuration. No CPE strings were supplied; affected-version data in the EUVD is listed only as 'n/a'.
RemediationAI
No vendor-released patch identified at time of analysis - SourceCodester's tutorial-grade releases rarely receive security fixes. As the primary control, remediate the code directly by converting the delete_group.php query to a parameterized/prepared statement (PDO or mysqli bound parameters) and casting 'id' to an integer before use. As compensating controls until fixed: restrict access to the /admin/ directory to trusted source IPs or place it behind an authenticated reverse proxy (trade-off: breaks legitimate remote admin access); deploy a WAF rule to block SQL metacharacters on the id parameter of /admin/delete_group.php (trade-off: signature-based rules can be bypassed and may cause false positives); and enforce least-privilege on the MySQL account so it cannot use stacked queries, DROP, or FILE operations (trade-off: none significant, recommended regardless). Consult the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-69948) and VulDB (https://vuldb.com/vuln/385146) for updates.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today