CVE-2025-10087: Pet Grooming Management SQLi Vulnerability

CVE-2025-10087 Overview

CVE-2025-10087 is a SQL injection vulnerability in SourceCodester Pet Grooming Management Software 1.0, developed by Mayurik. The flaw resides in the /admin/profit_report.php script, where the product_id parameter is passed unsanitized into a backend SQL query. An authenticated attacker can manipulate the parameter remotely to alter query logic and access or modify database contents. The exploit technique has been disclosed publicly, increasing the likelihood of opportunistic abuse against exposed installations. This issue is tracked under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Successful exploitation allows tampering with backend SQL queries through the product_id parameter, leading to unauthorized read or write access to the application database.

Affected Products

Mayurik Pet Grooming Management Software 1.0
SourceCodester distribution of Pet Grooming Management Software
Deployments exposing /admin/profit_report.php to network access

Discovery Timeline

2025-09-08 - CVE-2025-10087 published to the National Vulnerability Database
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10087

Vulnerability Analysis

The vulnerability exists in the administrative profit reporting component of the application. The script /admin/profit_report.php accepts a product_id parameter and concatenates the value directly into a SQL statement without parameterization or input validation. An attacker with administrative access to the panel can inject SQL syntax to break out of the intended query context.

Because the attack is remote and requires only HTTP access to the admin endpoint, exploitation can be automated once credentials are obtained. The publicly disclosed proof-of-concept lowers the barrier for low-skilled adversaries. The EPSS probability is 0.365% with a percentile of 28.075, indicating moderate but non-zero likelihood of exploitation activity.

Root Cause

The root cause is the absence of prepared statements or input sanitization on the product_id parameter before it reaches the SQL execution layer. User-controlled data is treated as trusted SQL code rather than as a literal value, which is the defining condition for injection flaws categorized under CWE-74.

Attack Vector

The attacker submits a crafted HTTP request to /admin/profit_report.php containing SQL metacharacters in the product_id argument. The injected payload modifies the query to extract data through UNION-based, boolean-based, or time-based techniques. Authentication to the admin interface is required, but the network-reachable endpoint allows remote exploitation without user interaction. See the Medium Vulnerability Report and VulDB entry #323043 for technical details.

Detection Methods for CVE-2025-10087

Indicators of Compromise

HTTP requests to /admin/profit_report.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or INFORMATION_SCHEMA in the product_id parameter
Web server access logs showing repeated requests with varying product_id payload lengths from a single source
Unexpected database errors or anomalously long query response times originating from the profit reporting module

Detection Strategies

Deploy web application firewall signatures that flag SQL injection patterns targeting the product_id parameter on the admin path
Enable database query auditing to capture queries originating from profit_report.php and alert on syntactic anomalies
Correlate authentication logs with subsequent abnormal admin-page activity to identify compromised administrator sessions

Monitoring Recommendations

Monitor outbound database traffic for unusual SELECT volume or queries referencing system tables
Alert on HTTP 500 responses from the admin endpoint, which often indicate injection probing
Track failed and successful admin logins followed by access to reporting endpoints within short time windows

How to Mitigate CVE-2025-10087

Immediate Actions Required

Restrict network access to the /admin/ directory using IP allowlisting or VPN-only access until a fix is applied
Rotate administrative credentials and review audit logs for prior access to profit_report.php
Deploy a web application firewall rule blocking SQL metacharacters in the product_id parameter

Patch Information

No official vendor patch is currently published for Mayurik Pet Grooming Management Software 1.0. Operators should monitor the SourceCodester project page for updates and consider applying source-level fixes that replace string concatenation with parameterized queries in profit_report.php.

Workarounds

Modify profit_report.php to use prepared statements with bound parameters for all database calls referencing product_id
Enforce server-side input validation that restricts product_id to numeric values only
Run the database account used by the application with least-privilege permissions to limit the impact of successful injection

bash

# Example WAF rule snippet (ModSecurity) blocking SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@contains /admin/profit_report.php" \
    "chain,deny,status:403,id:1010087,msg:'CVE-2025-10087 SQLi attempt'"
    SecRule ARGS:product_id "@rx (?i)(union|select|sleep\(|--|';|/\*)" "t:none"