CVE-2025-10780: Simple Pharmacy Management SQLI Vulnerability

CVE-2025-10780 Overview

CVE-2025-10780 is a SQL injection vulnerability in CodeAstro Simple Pharmacy Management System 1.0. The flaw resides in the /view.php script, where the bar_code parameter is incorporated into a SQL query without proper sanitization. Remote attackers with low privileges can manipulate the parameter to alter query logic and access or modify backend database content. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed installations. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Injection).

Critical Impact
Authenticated remote attackers can inject SQL through the bar_code parameter in /view.php, exposing pharmacy database contents to read or modification.

Affected Products

CodeAstro Simple Pharmacy Management System 1.0
CPE: cpe:2.3:a:codeastro:simple_pharmacy_management_system:1.0:*:*:*:*:*:*:*
Affected component: /view.php (bar_code parameter)

Discovery Timeline

2025-09-22 - CVE-2025-10780 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10780

Vulnerability Analysis

The vulnerability is a SQL injection flaw in the pharmacy management web application. The /view.php endpoint accepts a bar_code query parameter and concatenates the value into a SQL statement that retrieves product or inventory records. Because the application does not use parameterized queries or properly escape user-supplied input, an attacker can append SQL syntax to break out of the original query context.

Exploitation requires network access to the web interface and a low-privilege account, but does not require user interaction. The injection enables retrieval of arbitrary table data, including credentials, patient or inventory records, and potentially destructive operations through stacked or UNION-based queries.

The public disclosure on the GitHub CVE Issue Report and VulDB #325136 lowers the barrier to weaponization. The EPSS probability of 0.308% (22.46 percentile) reflects current observed exploitation activity, not the practical ease of the attack.

Root Cause

The root cause is missing input validation and the use of dynamic SQL construction in /view.php. User-controlled data flowing into the bar_code argument is interpolated directly into the database query string without prepared statements or type enforcement.

Attack Vector

The attack vector is remote over HTTP/HTTPS. An attacker authenticated with any low-privileged role submits a crafted bar_code value, for example via a GET or POST request to /view.php, that contains SQL meta-characters such as single quotes, UNION SELECT, or boolean payloads to enumerate the database schema and exfiltrate data.

No verified proof-of-concept code is published in the referenced advisories beyond the descriptive issue report. See the VulDB CTI ID #325136 record for additional context on the disclosed attack pattern.

Detection Methods for CVE-2025-10780

Indicators of Compromise

HTTP requests to /view.php containing SQL meta-characters in the bar_code parameter, such as ', --, UNION, SELECT, SLEEP(, or OR 1=1.
Web server access logs showing repeated requests to /view.php with anomalously long or encoded bar_code values.
Database error messages returned in HTTP responses referencing MySQL or MariaDB syntax errors tied to the bar_code query.
Unexpected reads against pharmacy tables or sudden increases in row volume returned by /view.php.

Detection Strategies

Deploy web application firewall signatures that flag SQL injection payloads targeting the bar_code query parameter.
Enable database query logging and alert on queries against pharmacy tables that contain tautologies, UNION, or INFORMATION_SCHEMA references originating from the application user.
Correlate authentication events with subsequent abnormal access patterns to /view.php from the same session or IP.

Monitoring Recommendations

Forward web server, application, and database logs to a centralized analytics platform for query inspection and retention.
Baseline normal bar_code parameter values such as numeric or alphanumeric barcodes and alert on deviations.
Monitor outbound connections from the application host that could indicate post-injection data exfiltration.

How to Mitigate CVE-2025-10780

Immediate Actions Required

Restrict network exposure of the Simple Pharmacy Management System to trusted internal networks or VPN access until a fix is available.
Audit application accounts and disable or rotate credentials for any low-privilege accounts that are not strictly required.
Place a web application firewall in front of /view.php with rules blocking SQL meta-characters in the bar_code parameter.
Review database logs for evidence of prior injection attempts against /view.php.

Patch Information

No official patch from CodeAstro is referenced in the NVD entry at the time of publication. Monitor the CodeAstro vendor site and the GitHub CVE Issue Report for updates. Where source access is available, replace dynamic SQL in /view.php with prepared statements using PDO or mysqli parameter binding, and enforce server-side type validation on bar_code.

Workarounds

Apply a WAF rule that rejects requests to /view.php when bar_code contains characters outside the expected barcode character set.
Restrict the database account used by the application to read-only access on required tables, eliminating destructive injection outcomes.
Disable verbose database error messages in the application to prevent schema disclosure through error-based injection.

bash

# Example ModSecurity rule blocking SQL meta-characters in bar_code
SecRule ARGS:bar_code "@rx [\'\";()]|--|\bUNION\b|\bSELECT\b|\bOR\b\s+\d+=\d+" \
  "id:1010780,phase:2,deny,status:403,log,\
   msg:'CVE-2025-10780 SQLi attempt on /view.php bar_code'"