CVE-2025-10592: Carenlove OPAC SQLi Vulnerability

CVE-2025-10592 Overview

CVE-2025-10592 is a SQL injection vulnerability in itsourcecode Online Public Access Catalog (OPAC) 1.0. The flaw resides in the mysearch.php file and affects how the POST parameter handler processes the search_field and search_text arguments. Attackers can manipulate these parameters to inject arbitrary SQL statements into back-end queries. The vulnerability is exploitable remotely over the network and requires only low-level authenticated privileges. A public exploit has been disclosed, increasing the likelihood of opportunistic abuse. The issue is tracked under [CWE-89] SQL Injection and [CWE-74] Improper Neutralization of Special Elements.

Critical Impact
Authenticated remote attackers can manipulate search_field or search_text POST parameters in mysearch.php to execute arbitrary SQL against the OPAC database.

Affected Products

Carenlove Online Public Access Catalog 1.0
mysearch.php POST parameter handler component
Installations exposing the OPAC web interface to untrusted networks

Discovery Timeline

2025-09-17 - CVE-2025-10592 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10592

Vulnerability Analysis

The vulnerability stems from unsanitized user input in the mysearch.php search handler. The application concatenates the search_field and search_text POST parameters directly into SQL statements without parameterization or input validation. An authenticated attacker submits crafted payloads containing SQL metacharacters and statement terminators. The database executes the injected fragments alongside the intended query. Successful exploitation can disclose catalog data, modify records, or, depending on database privileges, extend access beyond the application context. Public disclosure of the proof-of-concept lowers the barrier to exploitation against unpatched installations.

Root Cause

The root cause is improper neutralization of special characters in SQL queries [CWE-89]. The mysearch.php handler builds dynamic SQL using string concatenation of POST inputs rather than using prepared statements with bound parameters. No allowlist validation is applied to search_field, which appears to be reflected into a column reference, nor to search_text, which is reflected into a value clause.

Attack Vector

The attack vector is network-based against the OPAC web application. An attacker authenticates with low privileges and submits a POST request to mysearch.php containing SQL injection payloads in search_field or search_text. The vulnerability does not require user interaction beyond the attacker's own session. A public proof-of-concept is referenced in the GitHub PoC Repository, demonstrating exploitation steps against mysearch.php.

No verified exploit code is included here. Refer to the linked PoC and the VulDB entry #324609 for technical specifics.

Detection Methods for CVE-2025-10592

Indicators of Compromise

POST requests to /mysearch.php containing SQL metacharacters such as ', ", --, UNION, SELECT, or SLEEP( within the search_field or search_text parameters.
Web server access logs showing repeated 200 responses to mysearch.php with abnormally long request bodies or encoded payloads.
Database error messages referencing syntax errors originating from mysearch.php request handling.
Unexpected outbound database queries returning large result sets to low-privileged OPAC user sessions.

Detection Strategies

Deploy web application firewall (WAF) rules to inspect POST bodies submitted to mysearch.php and block known SQL injection signatures.
Enable database query logging and alert on tautologies (OR 1=1), UNION SELECT patterns, and time-based functions issued from the OPAC application user.
Correlate authentication events with subsequent mysearch.php POST volume to surface accounts probing the parameter handler.

Monitoring Recommendations

Monitor application logs for HTTP 500 errors and database exceptions tied to the search workflow.
Track schema enumeration attempts such as queries against information_schema.tables or information_schema.columns from the OPAC database account.
Alert on outbound data volume spikes from the database host that coincide with OPAC search traffic.

How to Mitigate CVE-2025-10592

Immediate Actions Required

Restrict network access to the OPAC application to trusted users and IP ranges until a patch is applied.
Disable the mysearch.php endpoint or place the application behind a WAF with SQL injection rules enabled.
Rotate database credentials used by the OPAC application and ensure the account has least-privilege access to catalog tables only.
Review historical logs for evidence of prior exploitation of search_field or search_text.

Patch Information

No vendor advisory or official patch is referenced in the available data. Operators should monitor the IT Source Code Blog and the VulDB CTI entry for fix announcements. Until a vendor patch is released, organizations should remediate the mysearch.php handler in-house by replacing string-concatenated SQL with prepared statements using bound parameters and by enforcing an allowlist on search_field values.

Workarounds

Apply a WAF rule that rejects POST requests to mysearch.php containing SQL metacharacters in search_field or search_text.
Enforce server-side allowlisting of search_field to a fixed set of valid column identifiers before constructing the query.
Run the OPAC database account with the minimum privileges required for catalog reads, eliminating write or schema introspection rights.
Consider taking the application offline if it is internet-exposed and cannot be placed behind compensating controls.

bash

# Example ModSecurity rule blocking SQLi payloads in mysearch.php POST parameters
SecRule REQUEST_URI "@endsWith /mysearch.php" \
  "phase:2,chain,deny,status:403,id:1010592,msg:'Potential SQLi against OPAC mysearch.php (CVE-2025-10592)'"
  SecRule ARGS:search_field|ARGS:search_text "@rx (?i)(union(\s|/\*.*\*/)+select|or\s+1=1|sleep\s*\(|--\s|;\s*drop\s+)" \
    "t:none,t:urlDecodeUni"