CVE-2025-10839: Pet Grooming Management SQLI Vulnerability

CVE-2025-10839 Overview

CVE-2025-10839 is a SQL injection vulnerability affecting SourceCodester Pet Grooming Management Software 1.0, developed by Mayurik. The flaw resides in the /admin/inv-print.php script, where the ID parameter is passed directly into a SQL query without proper sanitization or parameterization. An authenticated remote attacker can manipulate the ID argument to inject arbitrary SQL statements against the backend database. Public exploit details have been released, increasing the likelihood of opportunistic attacks against exposed installations. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote attackers with low privileges can read, modify, or delete records in the application database through crafted SQL payloads sent to /admin/inv-print.php.

Affected Products

Mayurik Pet Grooming Management Software 1.0
SourceCodester Pet Grooming Management Software 1.0
CPE: cpe:2.3:a:mayurik:pet_grooming_management_software:1.0:*:*:*:*:*:*:*

Discovery Timeline

2025-09-23 - CVE-2025-10839 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10839

Vulnerability Analysis

The vulnerability exists in the invoice printing component of the administrative interface. The inv-print.php script accepts an ID query parameter intended to identify a specific invoice record. The application concatenates this parameter directly into a SQL statement before sending it to the database engine. Because there is no input validation, type casting, or use of prepared statements, an attacker can break out of the intended query context and append arbitrary SQL clauses.

The exploit is remotely reachable over the network and requires only low-privileged authentication to the administrative panel. The Common Weakness Enumeration mapping is [CWE-74], reflecting improper neutralization of special elements used in a downstream SQL query.

Root Cause

The root cause is the absence of parameterized queries or input sanitization in the handler for /admin/inv-print.php. The ID argument flows from the HTTP request into the SQL query string without being constrained to an integer type or escaped through a database driver API. This pattern, common in PHP applications that use direct string concatenation with mysqli_query or similar functions, allows query syntax to be modified by attacker-supplied input.

Attack Vector

An attacker authenticated to the admin interface sends an HTTP request to /admin/inv-print.php with a manipulated ID parameter containing SQL metacharacters such as single quotes, UNION SELECT clauses, or boolean-based blind injection payloads. The database executes the attacker-controlled clauses, returning data or modifying records depending on the database user's privileges. The exploit technique has been documented publicly in the GitHub SQL Injection Vulnerability writeup and tracked in VulDB #325201.

No verified exploit code is reproduced here. See the referenced advisories for technical proof-of-concept details.

Detection Methods for CVE-2025-10839

Indicators of Compromise

HTTP requests to /admin/inv-print.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the ID parameter.
Web server access logs showing unusually long or URL-encoded values in the ID query string parameter.
Database error messages or stack traces returned to clients accessing invoice printing endpoints.
Unexpected database read or write operations originating from the web application service account.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query parameters to /admin/inv-print.php and block known SQL injection signatures.
Enable verbose query logging on the backend MySQL/MariaDB instance and alert on statements containing tautologies such as OR 1=1 or stacked queries.
Correlate authentication events with administrative endpoint access to identify abuse of low-privileged accounts.

Monitoring Recommendations

Monitor outbound database traffic from the web server for anomalous query volume or schema enumeration patterns (information_schema access).
Track HTTP response codes and payload sizes for inv-print.php to detect data exfiltration via UNION-based injection.
Aggregate web, application, and database telemetry into a centralized analytics platform for cross-source correlation.

How to Mitigate CVE-2025-10839

Immediate Actions Required

Restrict network exposure of the /admin/ directory to trusted management networks or VPN clients only.
Audit all administrative accounts and rotate credentials, removing unused or shared logins that could be abused for authenticated injection.
Deploy a WAF rule set that blocks SQL metacharacters in the ID parameter of inv-print.php until a code-level fix is applied.
Review web and database logs for prior exploitation attempts referencing inv-print.php.

Patch Information

No official vendor patch has been published for CVE-2025-10839 at the time of writing. Administrators should monitor the SourceCodester project page and the VulDB entry for updates. Until a fix is released, organizations should apply the workarounds below or discontinue use of the affected version.

Workarounds

Modify inv-print.php to cast the ID parameter to an integer using intval() before constructing the SQL query.
Replace string-concatenated SQL with prepared statements using mysqli or PDO parameter binding.
Apply least-privilege principles to the database account used by the application, removing DROP, ALTER, and FILE privileges.
Place the application behind an authenticating reverse proxy that enforces additional access controls on /admin/ paths.

bash

# Example ModSecurity rule to block SQL metacharacters in the ID parameter
SecRule REQUEST_URI "@beginsWith /admin/inv-print.php" \
    "chain,deny,status:403,id:1010839,msg:'CVE-2025-10839 SQLi attempt'"
    SecRule ARGS:ID "@rx [\'\";]|--|\bUNION\b|\bSELECT\b|\bSLEEP\b" "t:lowercase"