CVE-2025-10826: Beauty Parlor Management SQLI Vulnerability

CVE-2025-10826 Overview

CVE-2025-10826 is a SQL injection vulnerability in Campcodes Online Beauty Parlor Management System 1.0. The flaw exists in /admin/sales-reports-detail.php, where the fromdate and todate parameters are passed to backend queries without proper sanitization. Authenticated attackers can manipulate these parameters to inject arbitrary SQL statements. The vulnerability is remotely exploitable over the network and a public proof-of-concept has been released. The issue is classified under CWE-74 (Improper Neutralization of Special Elements in Output).

Critical Impact
Authenticated remote attackers can execute arbitrary SQL queries against the application database, leading to data disclosure, modification, or further compromise of the management system.

Affected Products

Campcodes Online Beauty Parlor Management System 1.0
Component: /admin/sales-reports-detail.php
Vulnerable parameters: fromdate, todate

Discovery Timeline

2025-09-23 - CVE-2025-10826 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10826

Vulnerability Analysis

The vulnerability resides in the administrative sales reporting functionality of the Online Beauty Parlor Management System. The script /admin/sales-reports-detail.php accepts user-supplied date range values through the fromdate and todate request parameters. These values are concatenated directly into SQL statements without parameterization or input validation. An attacker with low-privilege administrative access can supply crafted SQL payloads through either parameter to alter query logic. Successful exploitation enables unauthorized read and write access to backend database tables containing customer records, sales data, and credentials.

Root Cause

The root cause is improper neutralization of special characters in user-controlled input passed to a database query, mapped to [CWE-74]. The PHP code path handling the date range filter constructs SQL strings through concatenation rather than using prepared statements with bound parameters. No allowlist or type validation is performed on the date inputs before they reach the SQL execution layer.

Attack Vector

The attack is launched remotely over HTTP against the administrative interface. An authenticated user submits a request to /admin/sales-reports-detail.php with malicious SQL syntax embedded in the fromdate or todate GET or POST parameter. Common payloads use UNION SELECT statements to extract data from other tables or boolean-based blind techniques to enumerate the schema. A public proof-of-concept is hosted at the GitHub PoC Repository.

No verified exploit code is reproduced here. Refer to the published advisory for technical specifics.

Detection Methods for CVE-2025-10826

Indicators of Compromise

HTTP requests to /admin/sales-reports-detail.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or /* within the fromdate or todate parameters.
Unusual database error messages returned by the application in response to date filter requests.
Spikes in response size or latency for the sales reports endpoint, indicative of UNION-based or time-based blind SQL injection.
Web server access logs showing repeated requests to the endpoint from a single source with varying payload structures.

Detection Strategies

Deploy Web Application Firewall (WAF) signatures targeting SQL injection patterns on the fromdate and todate parameters of the affected endpoint.
Enable database query auditing to flag queries containing concatenated user-controlled date strings or queries deviating from the application's normal SQL fingerprint.
Correlate authentication events with administrative endpoint access to identify credential misuse preceding injection attempts.

Monitoring Recommendations

Forward web server and PHP error logs to a centralized analytics platform and alert on SQL syntax errors originating from the sales reports module.
Monitor outbound database connections from the application host for unusual query volume or data exfiltration patterns.
Track administrative session activity for anomalous report generation behavior outside of normal business hours.

How to Mitigate CVE-2025-10826

Immediate Actions Required

Restrict network access to the /admin/ directory using IP allowlisting or VPN-only access until a fix is available.
Rotate credentials for all administrative accounts and the underlying database service account.
Review database logs for evidence of prior injection attempts against the sales-reports-detail.php endpoint.
Enable a WAF in blocking mode with rules targeting SQL injection on the affected parameters.

Patch Information

No vendor patch has been published in the referenced advisories at the time of writing. Track the VulDB entry #325183 and the CampCodes Blog for vendor updates. Until an official patch is released, apply compensating controls and consider replacing the affected component with a maintained alternative.

Workarounds

Modify the PHP source to use prepared statements with parameterized queries via PDO or MySQLi, binding fromdate and todate as typed parameters.
Enforce strict server-side input validation that rejects any value not matching a strict date format such as YYYY-MM-DD.
Apply the principle of least privilege to the database account used by the application, removing rights to tables not required by the reporting module.
If the sales reporting feature is non-essential, disable the endpoint by removing or restricting access to sales-reports-detail.php.

bash

# Example Apache configuration to restrict access to the vulnerable endpoint
<Files "sales-reports-detail.php">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Files>