CVE-2025-4806: Stock Management System SQLi Vulnerability

CVE-2025-4806 Overview

CVE-2025-4806 is a SQL injection vulnerability in SourceCodester/oretnom23 Stock Management System 1.0. The flaw resides in the /admin/?page=back_order/view_bo endpoint, where the ID parameter is passed to a backend SQL query without proper sanitization. An authenticated remote attacker can manipulate the ID argument to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed instances. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Injection).

Critical Impact
Remote attackers with low-privileged accounts can extract, modify, or delete data in the application database through SQL injection on the back order management page.

Affected Products

Oretnom23 Stock Management System 1.0
SourceCodester PHP-based Stock Management System (SMS-PHP)
Deployments using the /admin/?page=back_order/view_bo admin module

Discovery Timeline

2025-05-16 - CVE-2025-4806 published to NVD
2025-05-28 - Last updated in NVD database

Technical Details for CVE-2025-4806

Vulnerability Analysis

The vulnerability exists in the back order viewing functionality of the admin interface. When a user requests /admin/?page=back_order/view_bo, the application accepts an ID parameter intended to identify a back order record. The application concatenates this parameter directly into a SQL query without parameterized statements or input validation. Attackers can append SQL syntax such as UNION SELECT payloads, boolean-based blind probes, or time-based payloads to enumerate database schema, exfiltrate credentials, or modify records. Because the vulnerable endpoint resides in the administrative path, exploitation requires an authenticated session, but the attack is achievable over the network without user interaction.

Root Cause

The root cause is the direct interpolation of user-controlled input into a SQL statement. The application does not use prepared statements, parameter binding, or input filtering on the ID value supplied to the back order view handler. This violates secure coding practices for database access in PHP and corresponds to CWE-89.

Attack Vector

The attack vector is network-based. An attacker with a valid low-privileged admin panel session sends a crafted HTTP GET request to /admin/?page=back_order/view_bo&id=<payload>. The injected payload is executed by the underlying MySQL engine. Common exploitation patterns include error-based extraction, UNION-based data retrieval, and time-based blind injection using SLEEP() to confirm execution. Refer to the public vulnerability writeup on GitHub and VulDB entry #309260 for technical proof-of-concept details.

Detection Methods for CVE-2025-4806

Indicators of Compromise

HTTP requests to /admin/?page=back_order/view_bo containing SQL metacharacters such as ', ", --, UNION, SELECT, or SLEEP( in the id parameter.
Web server access logs showing unusually long query strings or encoded payloads targeting the id parameter.
Database error messages returned to clients accessing the back order page.
Spikes in response latency on requests to view_bo, consistent with time-based blind SQL injection.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set such as OWASP CRS to flag SQL injection signatures on the admin path.
Enable MySQL general query logging and review queries originating from the back order module for anomalous syntax.
Correlate authentication events with subsequent suspicious GET requests against view_bo to identify compromised admin accounts.

Monitoring Recommendations

Forward web server and PHP error logs to a centralized SIEM for real-time pattern matching on SQL injection payloads.
Alert on repeated 500-level responses from /admin/?page=back_order/view_bo, which often indicate exploitation attempts.
Monitor administrative account activity for logins from unexpected geolocations or off-hours access prior to anomalous database queries.

How to Mitigate CVE-2025-4806

Immediate Actions Required

Restrict network access to the /admin/ path using IP allowlisting or VPN-only access until a patched version is available.
Rotate all administrative credentials and audit existing admin accounts for unauthorized additions.
Review database contents and audit logs for evidence of unauthorized read or write activity against back order tables.
Place a WAF in blocking mode in front of the application to filter SQL injection payloads against the id parameter.

Patch Information

No official vendor patch has been published for Stock Management System 1.0 at the time of this writing. Operators should monitor the SourceCodester project page and the VulDB advisory for updates. Until an official fix is released, source-level remediation requires replacing string concatenation with prepared statements using PDO or MySQLi parameter binding in the back order handler.

Workarounds

Apply a virtual patch at the WAF layer that rejects requests to view_bo containing SQL metacharacters in the id parameter.
Modify the affected PHP source to cast the id value to an integer before use in the SQL query, for example using intval($_GET['id']).
Enforce least privilege on the database account used by the application so that it cannot execute schema modification or read unrelated tables.
Consider taking the application offline or restricting it to internal networks if administrative exposure to the internet is not required.

bash

# Example Apache rule to block suspicious id parameter values targeting view_bo
<LocationMatch "/admin/">
    SetEnvIfNoCase Query_String "page=back_order/view_bo.*id=.*(union|select|sleep|--|/\*)" block_sqli
    Require not env block_sqli
</LocationMatch>