CVE-2025-10402: Beauty Parlour Management System SQLi Flaw

CVE-2025-10402 Overview

A SQL injection vulnerability has been identified in PHPGurukul Beauty Parlour Management System version 1.1. The vulnerability exists in the /admin/readenq.php file, where improper handling of the delid parameter allows attackers to inject malicious SQL queries. This flaw can be exploited remotely without authentication, potentially enabling unauthorized access to sensitive database information, data manipulation, or further compromise of the underlying system.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to extract sensitive data, modify database contents, or potentially gain unauthorized access to the backend database server.

Affected Products

• PHPGurukul Beauty Parlour Management System 1.1

Discovery Timeline

• 2025-09-14 - CVE-2025-10402 published to NVD
• 2025-09-18 - Last updated in NVD database

Technical Details for CVE-2025-10402

Vulnerability Analysis

This SQL injection vulnerability affects the administrative functionality of PHPGurukul Beauty Parlour Management System. The vulnerable endpoint /admin/readenq.php processes the delid parameter without proper input sanitization or parameterized query handling. When an attacker supplies crafted input to this parameter, the application directly incorporates it into SQL queries executed against the backend database.

The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The network-accessible attack vector with low complexity makes this vulnerability exploitable by remote attackers without requiring any user interaction or prior authentication.

Root Cause

The root cause of this vulnerability is the lack of proper input validation and sanitization for the delid parameter in /admin/readenq.php. The application directly concatenates user-supplied input into SQL queries rather than using prepared statements or parameterized queries. This classic SQL injection pattern allows attackers to break out of the intended query structure and inject arbitrary SQL commands.

Attack Vector

The attack can be executed remotely over the network by sending specially crafted HTTP requests to the vulnerable endpoint. An attacker manipulates the delid parameter to inject SQL syntax that modifies the behavior of the underlying database query. This could involve appending UNION-based payloads to extract data from other tables, boolean-based blind injection to infer database contents, or time-based techniques to exfiltrate information.

The vulnerability has been publicly disclosed, and exploit information is available through the GitHub Issue Report and VulDB #323837. Attackers can leverage this publicly available information to craft working exploits against unpatched installations.

Detection Methods for CVE-2025-10402

Indicators of Compromise

• Unusual SQL error messages in web server logs originating from /admin/readenq.php
• HTTP requests to /admin/readenq.php containing suspicious characters in the delid parameter such as single quotes, UNION statements, or SQL keywords
• Database query logs showing anomalous queries with unexpected syntax or timing-based functions
• Evidence of data exfiltration or unauthorized database modifications

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in the delid parameter targeting /admin/readenq.php
• Monitor web server access logs for requests containing SQL injection payloads such as ', --, UNION, SELECT, or OR 1=1
• Configure database activity monitoring to alert on unusual query patterns or error rates
• Deploy intrusion detection signatures for known SQL injection attack patterns

Monitoring Recommendations

• Enable detailed logging for the web application and database server to capture all queries executed against the enquiry management functionality
• Set up real-time alerting for SQL syntax errors or injection attempts in application logs
• Monitor for unusual database access patterns, particularly bulk data retrieval or administrative operations
• Regularly review access logs for the /admin/ directory for unauthorized or suspicious activity

How to Mitigate CVE-2025-10402

Immediate Actions Required

• Restrict access to the /admin/ directory using IP whitelisting or VPN requirements until a patch is applied
• Implement a Web Application Firewall with SQL injection protection rules
• Consider taking the application offline if it contains sensitive data and no mitigation is feasible
• Audit database logs for evidence of prior exploitation

Patch Information

At the time of publication, no official patch has been released by PHPGurukul for this vulnerability. Organizations should monitor the PHP Gurukul Home Page for security updates. Given the lack of vendor response, consider migrating to an alternative, actively maintained salon management solution.

Workarounds

• Implement input validation at the web server level to reject requests with SQL metacharacters in the delid parameter
• Deploy a reverse proxy or WAF configured with strict SQL injection detection rules for all requests to /admin/readenq.php
• Modify the source code to use prepared statements with parameterized queries for all database operations involving user input
• Apply the principle of least privilege to the database user account used by the application, limiting permissions to only necessary operations

# Example Apache .htaccess rule to restrict access to admin directory
<Directory "/var/www/html/admin">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
</Directory>