CVE-2025-51626: Xiaoliuchu Pss.sale.com SQLi Vulnerability

CVE-2025-51626 Overview

CVE-2025-51626 is a SQL injection vulnerability in pss.sale.com version 1.0, developed by xiaoliuchu. The flaw exists in the userfiles/php/cancel_order.php endpoint, where the id parameter is passed to a database query without proper sanitization. Unauthenticated remote attackers can inject arbitrary SQL statements over the network. Successful exploitation allows attackers to read and modify database records tied to order cancellation workflows. The vulnerability is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated attackers can inject SQL through the id parameter of cancel_order.php to disclose or tamper with backend database contents.

Affected Products

xiaoliuchu pss.sale.com 1.0
Deployments exposing userfiles/php/cancel_order.php to untrusted networks
Downstream forks of the Gitee-hosted pss.sale.com project

Discovery Timeline

2026-01-09 - CVE-2025-51626 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-51626

Vulnerability Analysis

The vulnerability resides in the cancel_order.php script located under the userfiles/php/ directory of the pss.sale.com application. The endpoint accepts an id parameter over HTTP and concatenates it directly into a SQL query used to identify the order record to cancel. Because the application does not validate the parameter type or use parameterized queries, attackers can append arbitrary SQL clauses to the original statement. This gives the attacker control over the query logic executed against the underlying database.

Exploitation requires no authentication and no user interaction. An attacker can issue crafted HTTP requests directly to the vulnerable endpoint from any network-reachable position. The impact is limited to confidentiality and integrity of database records, with no direct availability effect reported.

Root Cause

The root cause is unsanitized user input flowing into a SQL statement. The id parameter is trusted as a numeric identifier but is neither cast to an integer nor bound as a prepared statement parameter. Standard SQL injection payloads using UNION SELECT, boolean-based blind, or time-based techniques succeed against this input.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends a crafted GET or POST request to userfiles/php/cancel_order.php with a malicious id value. No credentials are required. The vulnerability is described in the GitHub PoC Repository and the project source is available in the Gitee Project Repository.

No verified exploit code is republished here. Refer to the public PoC referenced above for technical details on payload construction.

Detection Methods for CVE-2025-51626

Indicators of Compromise

HTTP requests to /userfiles/php/cancel_order.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP, or -- in the id parameter.
Unexpected database errors or long response times originating from cancel_order.php.
Access log entries showing repeated requests to cancel_order.php from a single source with varying id values.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag SQL injection patterns targeting the id parameter on the cancel_order.php path.
Enable database query logging and alert on parametric anomalies such as UNION-based queries or queries referencing information_schema from the web application user.
Correlate web access logs with database audit logs to identify request-to-query pairs exhibiting injection behavior.

Monitoring Recommendations

Monitor HTTP 500 responses and database error strings returned to clients from the pss.sale.com application.
Track outbound data volume from the database host to detect bulk record extraction.
Alert on any modification to tables associated with orders or customer records outside of normal application workflows.

How to Mitigate CVE-2025-51626

Immediate Actions Required

Restrict network access to the pss.sale.com application, placing userfiles/php/cancel_order.php behind authentication or a trusted network segment.
Deploy WAF rules that block SQL injection payloads submitted to the id parameter.
Review database and application logs for signs of prior exploitation attempts against the affected endpoint.

Patch Information

No vendor advisory or official patch has been published for CVE-2025-51626 at the time of writing. Operators should replace the vulnerable query with a parameterized statement, cast id to an integer before use, and enforce least-privilege database credentials for the web application account. Monitor the Gitee Project Repository for upstream fixes.

Workarounds

Apply an input filter at the web server or reverse proxy layer to reject non-numeric values submitted to the id parameter.
Disable or remove the cancel_order.php endpoint if the order cancellation feature is not required in production.
Constrain the database account used by the application to SELECT and UPDATE on only the tables required for order processing.

bash

# Example nginx rule rejecting non-numeric id values on the vulnerable endpoint
location ~* /userfiles/php/cancel_order\.php$ {
    if ($arg_id !~ "^[0-9]+$") {
        return 400;
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}