CVE-2025-10805: Campcodes Beauty Parlor System SQLi Flaw

CVE-2025-10805 Overview

CVE-2025-10805 is a SQL injection vulnerability affecting Campcodes Online Beauty Parlor Management System 1.0. The flaw resides in the /admin/add-services.php script, where the sername parameter is incorporated into a database query without proper sanitization. Authenticated attackers can manipulate this parameter remotely to inject arbitrary SQL statements. The vulnerability is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). A public proof-of-concept has been disclosed, increasing the likelihood of opportunistic exploitation against exposed deployments.

Critical Impact
Authenticated remote attackers can inject SQL commands through the sername parameter in add-services.php, potentially exposing or modifying database contents in affected installations.

Affected Products

Campcodes Online Beauty Parlor Management System 1.0
CPE: cpe:2.3:a:campcodes:online_beauty_parlor_management_system:1.0
Component: admin/add-services.php

Discovery Timeline

2025-09-22 - CVE-2025-10805 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10805

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input in the administrative service management interface. The /admin/add-services.php endpoint accepts a sername parameter and passes it directly into a SQL query without parameterization or input validation. Attackers with low-privilege authenticated access can submit crafted payloads that alter query syntax. Successful exploitation may allow reading, modifying, or deleting database records belonging to the beauty parlor management application. The EPSS probability sits in the lower quartile, but the public proof-of-concept lowers the barrier for opportunistic abuse.

Root Cause

The root cause is the direct concatenation of unsanitized HTTP request data into a SQL statement. The application does not use prepared statements or parameterized queries when handling the sername argument. No server-side input filter restricts SQL metacharacters such as single quotes, comments, or UNION clauses.

Attack Vector

Exploitation requires network access to the administrative interface and a valid low-privilege account. An attacker sends an HTTP request to /admin/add-services.php with a malicious sername value containing SQL syntax. The injected payload executes within the database context of the application user. Refer to the GitHub SQL Injection PoC for technical reproduction steps.

No verified exploit code is published in this advisory. Reproduction details are available in the linked proof-of-concept repository.

Detection Methods for CVE-2025-10805

Indicators of Compromise

HTTP POST or GET requests to /admin/add-services.php containing SQL metacharacters such as ', --, UNION, or SLEEP( in the sername parameter.
Unexpected database errors logged by the PHP application referencing the services table or sername field.
Administrative session activity originating from unfamiliar IP addresses targeting the add-services.php endpoint.

Detection Strategies

Deploy web application firewall (WAF) rules to flag SQL injection patterns submitted to /admin/add-services.php.
Review PHP and MySQL error logs for syntax errors triggered by malformed sername values.
Correlate authentication events with subsequent unusual query volumes against the application database.

Monitoring Recommendations

Enable verbose access logging on the administrative interface and forward logs to a centralized SIEM.
Monitor for spikes in failed login attempts followed by access to add-services.php.
Track database query patterns for anomalies such as boolean-based or time-based SQL injection signatures.

How to Mitigate CVE-2025-10805

Immediate Actions Required

Restrict network access to the /admin/ directory using IP allowlisting or VPN-only access until a patch is available.
Rotate administrative credentials and audit existing accounts for unauthorized activity.
Deploy WAF signatures targeting SQL injection against the sername parameter.

Patch Information

No official vendor patch has been published at the time of writing. Monitor the CampCodes website and VulDB entry #325163 for updates. Organizations should consider replacing or isolating the application until the vendor releases a fix.

Workarounds

Implement parameterized queries or prepared statements in add-services.php if source code modification is feasible.
Apply server-side input validation to reject non-alphanumeric characters in the sername field.
Place the application behind a reverse proxy with SQL injection filtering enabled.
Limit database account privileges used by the application to read/write only on required tables.

bash

# Example ModSecurity rule to block SQLi attempts on add-services.php
SecRule REQUEST_URI "@contains /admin/add-services.php" \
    "id:1010805,phase:2,deny,status:403,\
    msg:'Potential SQLi against add-services.php',\
    chain"
    SecRule ARGS:sername "@detectSQLi" "t:none"