CVE-2025-10825: Campcodes Beauty Parlor SQLI Vulnerability

CVE-2025-10825 Overview

CVE-2025-10825 is a SQL injection vulnerability in Campcodes Online Beauty Parlor Management System 1.0. The flaw resides in /admin/view-appointment.php, where the viewid parameter is concatenated into a SQL statement without sanitization. An authenticated remote attacker can manipulate the parameter to alter query logic and extract or modify database records. Public exploitation details are available through a GitHub proof-of-concept repository and VulDB entry #325182. The issue is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output) and affects the administrative interface of the application.

Critical Impact
Authenticated attackers can inject arbitrary SQL through the viewid parameter, potentially exposing appointment records, customer data, and administrative credentials stored in the backend database.

Affected Products

Campcodes Online Beauty Parlor Management System 1.0
Component: /admin/view-appointment.php
Vulnerable parameter: viewid

Discovery Timeline

2025-09-23 - CVE-2025-10825 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10825

Vulnerability Analysis

The vulnerability affects the appointment viewing page within the administrative interface of Campcodes Online Beauty Parlor Management System. The viewid request parameter is passed directly into a SQL query string without parameterization or input validation. An attacker with administrative-level access to the application can supply SQL syntax in this parameter to break out of the intended query context.

The attack requires network access and low-privilege authentication. Once exploited, the attacker can read arbitrary tables, modify records, or use database functions to enumerate the underlying schema. The PoC published on GitHub demonstrates UNION-based extraction of database contents through the viewid parameter.

Impact is limited to confidentiality, integrity, and availability of the application database. The EPSS score is 0.058% (18.293 percentile), reflecting low observed exploitation activity at this time.

Root Cause

The root cause is the direct concatenation of untrusted HTTP request input into a SQL query. The application does not employ prepared statements or parameterized queries. Input from the viewid GET parameter flows into the database driver without sanitization or type enforcement, classified under [CWE-74] as improper neutralization of special elements.

Attack Vector

Exploitation occurs over the network through a crafted HTTP request to /admin/view-appointment.php?viewid=<payload>. The attacker must hold valid admin-panel credentials to reach the endpoint. The payload injects SQL operators such as UNION SELECT or boolean tautologies to manipulate query results. Refer to the GitHub PoC Repository for the documented request structure.

Detection Methods for CVE-2025-10825

Indicators of Compromise

HTTP requests to /admin/view-appointment.php containing SQL keywords such as UNION, SELECT, SLEEP, or -- in the viewid parameter
Unexpected database errors logged by the PHP application referencing the appointment view query
Unusual outbound responses from the admin endpoint containing rows from tables other than appointment

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query strings for SQL injection signatures targeting the viewid parameter
Enable database query logging and alert on queries that join the appointment table with information_schema or mysql.user
Correlate admin session authentication events with anomalous query patterns originating from the same session token

Monitoring Recommendations

Monitor PHP error logs for SQL syntax exceptions originating from view-appointment.php
Track admin account logins from unusual IP addresses or geolocations preceding requests to the vulnerable endpoint
Forward web server access logs to a centralized SIEM and apply detection rules for SQLi patterns in administrative paths

How to Mitigate CVE-2025-10825

Immediate Actions Required

Restrict access to the /admin/ directory using IP allow-listing or VPN-only access until a fix is applied
Rotate administrative credentials and audit existing admin accounts for unauthorized additions
Review database audit logs for evidence of unauthorized SELECT, UPDATE, or DROP operations from the application service account

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Users should monitor the CampCodes site for an official update. As an interim measure, administrators should modify view-appointment.php to use prepared statements with bound parameters via mysqli or PDO, and cast viewid to an integer before use in any SQL context.

Workarounds

Implement server-side input validation that enforces viewid as a numeric integer and rejects any non-digit input
Deploy a WAF rule blocking SQL metacharacters (', ", ;, --, /*) in the viewid query parameter
Apply the principle of least privilege to the database user account used by the application, removing rights to system tables and write operations where not required

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns on the affected endpoint
SecRule REQUEST_URI "@beginsWith /admin/view-appointment.php" \
    "chain,phase:2,deny,status:403,id:1010825,msg:'SQLi attempt on viewid (CVE-2025-10825)'"
    SecRule ARGS:viewid "@detectSQLi" \
        "t:none,t:urlDecodeUni"