CVE-2025-10804: Beauty Parlor Management System SQLi Flaw

CVE-2025-10804 Overview

CVE-2025-10804 is a SQL injection vulnerability in Campcodes Online Beauty Parlor Management System 1.0. The flaw resides in /admin/add-customer.php, where the mobilenum parameter is passed to a database query without proper sanitization. Attackers with low-privileged authenticated access can manipulate this parameter to inject arbitrary SQL statements remotely. The vulnerability is tracked under CWE-74: Improper Neutralization of Special Elements in Output. A public proof-of-concept has been published, increasing the likelihood of opportunistic exploitation against exposed installations.

Critical Impact
Authenticated remote attackers can inject SQL statements through the mobilenum parameter to read, modify, or delete records in the beauty parlor management database.

Affected Products

Campcodes Online Beauty Parlor Management System 1.0
Component: /admin/add-customer.php
Vulnerable parameter: mobilenum

Discovery Timeline

2025-09-22 - CVE-2025-10804 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10804

Vulnerability Analysis

The vulnerability exists in the customer registration workflow of the administrative interface. When an administrator submits the add-customer form, the mobilenum field is incorporated into a SQL query without parameterized binding or input validation. This allows an attacker who possesses valid low-privilege credentials to append SQL syntax to the mobile number field. The public proof-of-concept demonstrates injection payloads that alter the intended query structure. Because the application is a PHP-based web system, the underlying database is typically MySQL, giving attackers access to standard SQL injection techniques such as UNION-based extraction and boolean-based blind extraction.

Root Cause

The root cause is the direct concatenation of user-supplied input into a SQL statement inside add-customer.php. The application does not use prepared statements with bound parameters, nor does it apply type coercion or whitelist validation to the mobilenum field. Any character permitted in an HTTP POST body reaches the database driver unfiltered.

Attack Vector

The attack is executed over the network against the administrative endpoint. The attacker authenticates to the admin panel, navigates to the add-customer form, and submits a crafted mobilenum value containing SQL metacharacters. Because the endpoint accepts standard form submissions, exploitation can be automated with tools such as sqlmap. Refer to the public proof-of-concept for the exact injection strings.

// No verified exploitation code is redistributed here.
// See the linked GitHub PoC for the sanitized injection payload
// targeting the mobilenum POST parameter in /admin/add-customer.php.

Detection Methods for CVE-2025-10804

Indicators of Compromise

POST requests to /admin/add-customer.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the mobilenum parameter.
Unexpected database error messages returned from the add-customer workflow in web server logs.
New or modified customer records with malformed mobile numbers containing SQL syntax fragments.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the mobilenum parameter on /admin/add-customer.php for SQL syntax patterns.
Enable database query logging and alert on queries originating from the add-customer endpoint that contain multiple statements or UNION clauses.
Correlate authentication events with high-volume submissions to the admin add-customer form to identify credential abuse.

Monitoring Recommendations

Monitor web server access logs for repeated POST requests to /admin/add-customer.php from a single source within short time windows.
Track outbound database traffic volume from the application host for anomalous spikes consistent with data exfiltration.
Review admin account activity for logins from unusual IP addresses or geographies preceding form submissions.

How to Mitigate CVE-2025-10804

Immediate Actions Required

Restrict access to /admin/ paths using IP allowlists or VPN-only access until a code fix is applied.
Rotate all administrator credentials for the Online Beauty Parlor Management System.
Audit the customer and user tables for unauthorized modifications or newly created privileged accounts.

Patch Information

No vendor advisory or official patch has been published by Campcodes for CVE-2025-10804 at the time of writing. Operators should refer to the CampCodes site and the VulDB entry for updates. Until an official patch is released, replace vulnerable SQL string concatenation in /admin/add-customer.php with parameterized queries using PHP PDO or mysqli prepared statements.

Workarounds

Apply server-side input validation on mobilenum to permit only digits and a limited length, rejecting all other characters.
Deploy WAF signatures that block SQL injection payloads targeting the mobilenum parameter on the add-customer endpoint.
Isolate the application database account with least-privilege grants so it cannot read or modify tables outside the parlor schema.

bash

# Example ModSecurity rule to block SQLi payloads in mobilenum
SecRule ARGS:mobilenum "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|--|;|')" \
  "id:1010804,phase:2,deny,status:403,\
   msg:'CVE-2025-10804 SQLi attempt in mobilenum',\
   logdata:'Matched Data: %{MATCHED_VAR}'"