CVE-2025-11357: Simple Banking System SQLi Vulnerability

CVE-2025-11357 Overview

CVE-2025-11357 is a SQL injection vulnerability in code-projects Simple Banking System 1.0. The flaw resides in the /createuser.php script, where the Name parameter is passed to a database query without proper sanitization. Attackers can remotely manipulate this argument to inject arbitrary SQL statements. The exploit has been publicly released, increasing the risk of opportunistic attacks against unpatched deployments. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated attackers can inject SQL through the Name parameter of /createuser.php to read, modify, or delete data in the banking application database.

Affected Products

Codeastro Simple Banking System 1.0
CPE: cpe:2.3:a:codeastro:simple_banking_system:1.0
PHP-based user creation module (/createuser.php)

Discovery Timeline

2025-10-07 - CVE-2025-11357 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11357

Vulnerability Analysis

The vulnerability exists in the user creation workflow of Simple Banking System 1.0. The /createuser.php endpoint accepts a Name parameter from HTTP requests and concatenates the value directly into a SQL statement. Because the application does not use parameterized queries or input validation, an attacker can break out of the intended string context and append arbitrary SQL clauses. The attack is executable over the network and requires only low privileges to reach the vulnerable endpoint.

Root Cause

The root cause is improper neutralization of user-supplied input before it is used in a database query [CWE-74]. The Name parameter flows into a dynamically constructed SQL statement without prepared statements, escaping, or type enforcement. This design flaw allows syntactic injection into the underlying query.

Attack Vector

An attacker sends a crafted HTTP request to /createuser.php containing SQL metacharacters in the Name field. Because the exploit has been publicly released, adversaries can automate probing of exposed Simple Banking System instances. Successful injection can lead to disclosure of account records, tampering with user data, or manipulation of authentication state within the application database.

No verified proof-of-concept code is reproduced here. Technical details are tracked in the GitHub CVE Issue Tracker and VulDB #327244.

Detection Methods for CVE-2025-11357

Indicators of Compromise

HTTP POST or GET requests to /createuser.php containing SQL metacharacters such as ', --, UNION, or OR 1=1 in the Name parameter.
Unexpected new rows, modified balances, or altered account records in the banking database following requests to the user creation endpoint.
Web server access logs showing repeated /createuser.php requests from a single source with varying Name payloads.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the Name parameter for SQL syntax and block common injection patterns.
Enable database query logging and alert on anomalous statements originating from the Simple Banking System application user.
Correlate web server request logs with database audit logs to identify injection attempts that reach the backend.

Monitoring Recommendations

Monitor for spikes in traffic to /createuser.php from external IP ranges.
Track error responses from PHP and MySQL that may indicate probing, such as syntax errors returned to the client.
Baseline normal query patterns for the application database and alert on deviations involving the users table.

How to Mitigate CVE-2025-11357

Immediate Actions Required

Restrict access to /createuser.php using network controls or authentication until a fix is applied.
Review database audit logs for prior exploitation attempts referencing the Name parameter.
Rotate database credentials used by the application if injection activity is suspected.

Patch Information

No vendor patch has been published in the referenced advisories. Refer to Code Projects Security Resources and VulDB CTI ID #327244 for updates. Because Simple Banking System 1.0 is distributed as source code, operators should manually patch /createuser.php to use prepared statements with bound parameters via PDO or mysqli.

Workarounds

Modify /createuser.php to validate the Name parameter against an allowlist of expected characters before use.
Replace string concatenation with parameterized queries using mysqli_prepare() or PDO::prepare().
Deploy a WAF in front of the application with signatures for SQL injection targeting the Name field.
Run the database account used by the application with the least privileges required, removing DROP and administrative rights.

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns in the Name parameter
SecRule ARGS:Name "@rx (?i)(union(.*?)select|or\s+1=1|--|;|/\*)" \
    "id:1011357,phase:2,deny,status:403,\
    msg:'CVE-2025-11357 SQLi attempt on createuser.php Name parameter'"