CVE-2025-12287: Bdtask Wholesale SQLI Vulnerability

CVE-2025-12287 Overview

CVE-2025-12287 is a SQL injection vulnerability in Bdtask Wholesale Inventory Control and Inventory Management System through version 20251013. The flaw resides in the /Admin_dashboard/edit_profile endpoint, where the first_name and last_name parameters are passed unsanitized into a backend SQL query. An authenticated remote attacker with administrative privileges can manipulate these arguments to alter query logic. A public proof-of-concept exists, and the vendor did not respond to coordinated disclosure attempts. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Improper Neutralization in Output).

Critical Impact
Authenticated attackers can inject arbitrary SQL through profile-editing fields, enabling tampering with backend data and limited disclosure of database contents.

Affected Products

Bdtask Wholesale Inventory Control and Inventory Management System (all releases up to and including 20251013)
CPE: cpe:2.3:a:bdtask:wholesale:*:*:*:*:*:*:*:*
Component: bdtask:wholesale

Discovery Timeline

2025-10-27 - CVE-2025-12287 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-12287

Vulnerability Analysis

The vulnerability exists in the administrative profile-editing functionality of the Bdtask Wholesale application. The handler at /Admin_dashboard/edit_profile accepts the first_name and last_name POST parameters and concatenates them into a SQL statement without parameterized binding or input sanitization. An attacker who holds administrator credentials can submit crafted strings containing SQL syntax. The injected payload executes within the database context used by the application. Public exploitation material is available through a GitHub proof-of-concept, increasing the likelihood of opportunistic abuse against exposed installations. The CVSS 4.0 vector indicates network reach but requires high privileges, limiting impact to scenarios where administrative access is already compromised or shared.

Root Cause

The root cause is unsafe construction of SQL queries from user-controlled input. The edit_profile handler does not apply prepared statements, type casting, or character escaping before passing first_name and last_name values into the query string. This pattern matches CWE-89, where input crossing a trust boundary modifies query structure rather than data.

Attack Vector

Exploitation requires authenticated access to the administrative dashboard. The attacker sends an HTTP request to /Admin_dashboard/edit_profile with malicious payloads embedded in the first_name or last_name form fields. The payload alters the underlying UPDATE or INSERT query to perform actions such as boolean-based blind extraction, UNION-based data retrieval, or time-based inference depending on the database engine. See the GitHub PoC for CVE-2025-12287 for request structure details.

No verified code examples are available. Refer to the VulDB advisory entry for the technical reproduction steps.

Detection Methods for CVE-2025-12287

Indicators of Compromise

HTTP POST requests to /Admin_dashboard/edit_profile containing SQL metacharacters such as single quotes, --, UNION, SLEEP(, or INFORMATION_SCHEMA in the first_name or last_name parameters.
Web server access logs showing repeated profile edits from a single session within short intervals.
Database error messages referencing syntax errors originating from profile-update queries.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect form fields submitted to the administrative dashboard for SQL injection signatures.
Enable database query logging and alert on UPDATE statements against profile tables that contain unexpected subqueries or comment sequences.
Correlate administrator authentication events with subsequent abnormal query patterns to identify credential abuse.

Monitoring Recommendations

Monitor outbound database traffic for unexpected data volumes following authenticated administrator sessions.
Audit all administrative accounts and review login geolocation, frequency, and user-agent consistency.
Track requests to /Admin_dashboard/* paths and baseline normal parameter content lengths and character sets.

How to Mitigate CVE-2025-12287

Immediate Actions Required

Restrict network access to the /Admin_dashboard/ path using IP allowlists or VPN-only access until a patch is available.
Rotate all administrator credentials and enforce multi-factor authentication on administrative accounts.
Review database logs for evidence of injection attempts dating back to deployment of any vulnerable build.

Patch Information

No vendor patch is available at the time of publication. The vendor was contacted but did not respond to disclosure. Track the VulDB entry for CVE-2025-12287 for future updates and monitor the vendor portal for new releases superseding version 20251013.

Workarounds

Place a WAF in front of the application with rules blocking SQL syntax in first_name and last_name POST parameters.
Apply a reverse-proxy rewrite rule that rejects requests to /Admin_dashboard/edit_profile containing characters such as ', ", ;, or --.
If source code access is available, replace dynamic query concatenation with parameterized prepared statements in the profile-update handler.
Limit administrative database account privileges to the minimum required tables to reduce the blast radius of successful injection.

bash

# Example nginx rule to block suspicious payloads on the vulnerable endpoint
location /Admin_dashboard/edit_profile {
    if ($request_method = POST) {
        if ($request_body ~* "(--|;|union[[:space:]]+select|sleep\(|information_schema)") {
            return 403;
        }
    }
    proxy_pass http://backend;
}