CVE-2025-1200: Best Church Management Software SQLi Flaw

CVE-2025-1200 Overview

CVE-2025-1200 is a SQL injection vulnerability in SourceCodester Best Church Management Software version 1.1, developed by Mayurik. The flaw resides in /admin/app/slider_crud.php, where the del_id parameter is passed directly into a SQL query without proper sanitization. Attackers can manipulate this argument to inject arbitrary SQL statements. The vulnerability is remotely exploitable over the network and requires only low-privileged authentication. Public disclosure of the exploitation technique has occurred through third-party vulnerability databases and GitHub documentation, increasing the likelihood of opportunistic abuse against exposed installations.

Critical Impact
Authenticated attackers can inject SQL statements through the del_id parameter in slider_crud.php, enabling unauthorized read or modification of backend database contents.

Affected Products

Mayurik Best Church Management Software 1.1
SourceCodester distribution of Best Church Management Software
Deployments using the slider_crud.php administrative component

Discovery Timeline

2025-02-12 - CVE-2025-1200 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1200

Vulnerability Analysis

The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). It affects the slider management functionality in the administrative interface of Best Church Management Software 1.1. The slider_crud.php script handles create, read, update, and delete operations for homepage slider records and accepts a del_id parameter to identify records targeted for deletion.

The affected code path concatenates the user-supplied del_id value directly into a SQL DELETE statement without parameterized queries or input validation. As a result, an attacker submitting crafted input can break out of the intended query context and append additional SQL syntax. Successful exploitation can extract data from any accessible table, modify records, or enumerate database schema details. Because the endpoint resides under /admin/, exploitation requires valid administrative session credentials, but no further user interaction is needed.

Root Cause

The root cause is direct interpolation of HTTP request input into a SQL query string. The application does not use prepared statements or escape the del_id value before passing it to the MySQL driver. Any character with SQL meaning, including single quotes, comment markers, and UNION keywords, passes through unmodified.

Attack Vector

Exploitation requires sending an HTTP request to /admin/app/slider_crud.php with a malicious del_id value. The attacker must hold a valid administrative session. No code example is published in verified sources beyond the referenced GitHub proof-of-concept documentation. See the GitHub SQL Injection Documentation for technical reproduction details.

Detection Methods for CVE-2025-1200

Indicators of Compromise

HTTP requests to /admin/app/slider_crud.php containing SQL metacharacters such as ', --, UNION, or SLEEP( in the del_id parameter
Web server access logs showing unusually long or URL-encoded del_id values from administrative sessions
Database error messages or stack traces returned in HTTP responses originating from slider_crud.php
Unexpected DELETE, SELECT, or INFORMATION_SCHEMA queries originating from the application database account

Detection Strategies

Deploy web application firewall (WAF) rules to inspect query string and POST body parameters for SQL injection patterns targeting the del_id argument
Enable database query logging and alert on queries referencing slider tables that contain UNION, SLEEP, or stacked statements
Correlate administrative authentication events with anomalous request volumes against slider_crud.php

Monitoring Recommendations

Forward web server, PHP error, and MySQL general query logs to a centralized analytics platform for continuous review
Baseline normal administrative traffic patterns to slider_crud.php and alert on deviations
Monitor for outbound data exfiltration from the database host following suspicious requests to the admin panel

How to Mitigate CVE-2025-1200

Immediate Actions Required

Restrict access to /admin/ paths through IP allowlisting or VPN-only access until a vendor fix is applied
Audit administrative account usage and rotate credentials for any account showing unusual activity
Review database logs for evidence of injection attempts and unauthorized data access
Apply input validation at a reverse proxy or WAF layer to reject non-numeric del_id values

Patch Information

No official vendor patch is referenced in the NVD entry or in the published advisories at the time of writing. Operators should monitor the SourceCodester Security Resources page and the VulDB entry #295108 for updates. Until a fix is released, treat the application as exposed and apply compensating controls.

Workarounds

Replace the vulnerable query in slider_crud.php with a parameterized statement using PDO or mysqli prepared statements, binding del_id as an integer
Add server-side type validation that casts del_id to an integer before any database interaction
Block public internet exposure of the administrative interface using network segmentation or authenticated reverse proxy rules

bash

# Example WAF rule (ModSecurity) to block SQLi patterns against slider_crud.php
SecRule REQUEST_URI "@contains /admin/app/slider_crud.php" \
    "chain,deny,status:403,id:1002025,msg:'Potential SQLi in del_id'"
  SecRule ARGS:del_id "!@rx ^[0-9]+$"