CVE-2025-6874: Best Salon Management System SQL Injection

CVE-2025-6874 Overview

CVE-2025-6874 is a SQL injection vulnerability in SourceCodester Best Salon Management System 1.0, developed by Mayurik. The flaw resides in the /panel/add_subscribe.php script, where the user_id and plan_id parameters are concatenated into SQL queries without proper sanitization. Remote authenticated attackers can manipulate these parameters to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the risk of opportunistic abuse against exposed deployments. The vulnerability is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Remote attackers with low-privilege access can inject SQL through user_id or plan_id parameters, leading to unauthorized data access, modification, or disclosure of salon customer and subscription records.

Affected Products

Mayurik Best Salon Management System 1.0
Vulnerable script: /panel/add_subscribe.php
Vulnerable parameters: user_id and plan_id

Discovery Timeline

2025-06-29 - CVE-2025-6874 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6874

Vulnerability Analysis

The vulnerability exists in the subscription handling logic of Best Salon Management System 1.0. The add_subscribe.php endpoint accepts user_id and plan_id parameters from HTTP requests and incorporates them directly into backend SQL queries. The application performs no parameterization, type casting, or input filtering on these values. Attackers can submit crafted payloads containing SQL meta-characters to alter query logic. This enables data extraction through UNION-based or boolean-based injection techniques. The endpoint is reachable over the network and requires only low-level authenticated access to exploit.

Root Cause

The root cause is improper neutralization of special elements in SQL statements, mapped to CWE-74. User-supplied input flows directly into a database query without prepared statements or input validation. The developer relied on implicit trust of authenticated session data rather than treating all user input as untrusted.

Attack Vector

The attack vector is network-based and requires low authentication privileges. An attacker submits a POST or GET request to /panel/add_subscribe.php containing malicious SQL fragments in the user_id or plan_id parameters. The injected SQL executes within the application's database context. Successful exploitation allows enumeration of database schemas, extraction of stored credentials, or modification of subscription records. Public disclosure on VulDB (entry #314346) and GitHub increases the likelihood of automated scanning against exposed instances.

No verified proof-of-concept code is provided in the vendor-neutral references. Technical details are available in the GitHub SQL Injection Documentation and the VulDB entry #314346.

Detection Methods for CVE-2025-6874

Indicators of Compromise

HTTP requests to /panel/add_subscribe.php containing SQL meta-characters such as single quotes, UNION SELECT, --, OR 1=1, or INFORMATION_SCHEMA references in the user_id or plan_id parameters.
Web server access logs showing unusually long parameter values or URL-encoded SQL keywords targeting the subscribe endpoint.
Database error messages referencing syntax errors originating from the add_subscribe.php request path.
Unexpected database queries reading from sensitive tables (users, credentials, subscriptions) outside normal subscription workflows.

Detection Strategies

Deploy a Web Application Firewall (WAF) with SQL injection signatures tuned to inspect parameters submitted to the /panel/ directory.
Enable database query logging and alert on anomalous queries containing UNION, sleep functions, or schema enumeration patterns originating from the application user.
Configure intrusion detection rules to flag SQLi payloads against PHP endpoints with parameters named user_id and plan_id.
Perform authenticated vulnerability scans against the application to identify the vulnerable endpoint and confirm patch status.

Monitoring Recommendations

Monitor authentication logs for low-privilege accounts accessing administrative or subscription endpoints outside expected business hours.
Track HTTP 500 responses from add_subscribe.php, which often indicate SQL syntax errors triggered by injection attempts.
Correlate web access logs with database audit logs to detect query patterns that diverge from application baselines.

How to Mitigate CVE-2025-6874

Immediate Actions Required

Restrict access to the /panel/ administrative interface using network-level controls or IP allowlisting until a patch is applied.
Audit all accounts with access to the subscription management functionality and remove inactive or unnecessary privileges.
Review database logs for evidence of injection attempts against add_subscribe.php and rotate any credentials that may have been exposed.
Deploy WAF rules to block requests containing SQL meta-characters on the affected endpoint.

Patch Information

No vendor patch is currently referenced in the NVD entry. Administrators should monitor the SourceCodester resource portal and the VulDB entry #314346 for updates. Until an official fix is released, organizations should consider applying source-level remediation by replacing inline SQL with parameterized queries using PDO prepared statements in add_subscribe.php.

Workarounds

Modify add_subscribe.php to validate that user_id and plan_id are strictly numeric before use in SQL queries.
Refactor database access to use PDO with bound parameters, eliminating direct string concatenation of user input.
Apply principle of least privilege to the database account used by the application, restricting it to only the tables and operations required for normal function.
Disable or remove the subscription module if it is not in active use within the deployment.

bash

# Example PHP remediation pattern using PDO prepared statements
$stmt = $pdo->prepare("INSERT INTO subscriptions (user_id, plan_id) VALUES (:user_id, :plan_id)");
$stmt->bindValue(':user_id', (int)$_POST['user_id'], PDO::PARAM_INT);
$stmt->bindValue(':plan_id', (int)$_POST['plan_id'], PDO::PARAM_INT);
$stmt->execute();