CVE-2025-6876: Best Salon Management System SQLi Flaw

CVE-2025-6876 Overview

CVE-2025-6876 is a SQL injection vulnerability in SourceCodester Best Salon Management System 1.0. The flaw resides in the /panel/add-category.php script, where the Name parameter is concatenated into a SQL query without proper sanitization. An authenticated remote attacker with low privileges can manipulate the parameter to inject arbitrary SQL syntax. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed deployments. The weakness is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated attackers can inject arbitrary SQL through the Name parameter in /panel/add-category.php, exposing salon customer records, appointment data, and administrative credentials.

Affected Products

Mayurik Best Salon Management System 1.0
SourceCodester distribution of Best Salon Management System
Deployments using the vulnerable /panel/add-category.php endpoint

Discovery Timeline

2025-06-29 - CVE-2025-6876 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-6876

Vulnerability Analysis

The vulnerability exists in the category creation workflow exposed through /panel/add-category.php. The script accepts a Name parameter from user input and includes it directly in a SQL statement executed against the backend database. Because the application does not parameterize the query or escape special characters, an attacker can break out of the intended string context and append arbitrary SQL clauses.

Exploitation requires network access to the administrative panel and a low-privilege authenticated session. Successful injection allows the attacker to read, modify, or delete database records. The injected statements execute with the database privileges granted to the application, which in PHP-based applications of this type typically include full read and write access to the application schema. Refer to the GitHub SQL Injection Analysis and VulDB #314348 for proof-of-concept details.

Root Cause

The root cause is the absence of prepared statements or input validation on the Name parameter before it reaches the SQL execution layer. The application builds queries through string concatenation, allowing attacker-supplied metacharacters such as single quotes, comments, and UNION keywords to alter query semantics.

Attack Vector

The attack vector is network-based against the /panel/add-category.php endpoint. An attacker submits a crafted POST or GET request containing SQL syntax in the Name field. Because the public disclosure includes working payloads, the barrier to exploitation is low for any actor that obtains panel credentials or compromises a low-privilege account.

// Vulnerability mechanism (described in prose, no verified PoC code reproduced)
// Endpoint: /panel/add-category.php
// Vulnerable parameter: Name
// Sink: SQL query built via string concatenation
// See https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-17.md for the public PoC

Detection Methods for CVE-2025-6876

Indicators of Compromise

HTTP requests to /panel/add-category.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the Name parameter
Web server logs showing repeated POST requests to add-category.php from a single source within a short time window
Database error messages referencing syntax errors near user-supplied input in application logs
Unexpected entries in the category table or unauthorized administrative accounts created shortly after suspicious requests

Detection Strategies

Deploy web application firewall rules that inspect the Name parameter on /panel/add-category.php for SQL injection signatures
Enable database query logging and alert on queries originating from the salon management application that contain UNION SELECT, INFORMATION_SCHEMA, or stacked statements
Correlate authentication events with administrative panel access to identify low-privilege accounts accessing category management functions outside normal business activity

Monitoring Recommendations

Monitor outbound database connections for anomalous query patterns or large result sets returned to the web tier
Track failed login attempts against /panel/ endpoints to identify credential stuffing that may precede exploitation
Review file integrity on the PHP application directory to detect web shells dropped through chained attacks following SQL injection

How to Mitigate CVE-2025-6876

Immediate Actions Required

Restrict network access to the /panel/ administrative interface using IP allowlisting or VPN-only access
Disable or remove the Best Salon Management System if it is not actively required, as the vendor has not published a fix
Rotate all administrative and database credentials, assuming prior exposure if the panel was internet-facing
Audit the category table and adjacent tables for unauthorized modifications

Patch Information

No official vendor patch has been published for CVE-2025-6876 at the time of NVD publication. SourceCodester and Mayurik have not released a security advisory. Organizations should treat the application as unsupported and apply compensating controls until a fix becomes available. Refer to VulDB CTI ID #314348 for tracking updates.

Workarounds

Place the application behind a web application firewall configured to block SQL injection patterns on all /panel/ parameters
Modify add-category.php to use parameterized queries via PDO or mysqli prepared statements if source-level changes are feasible
Apply database-layer least privilege by restricting the application user to the minimum required tables and removing FILE, CREATE, and DROP privileges
Implement input validation that rejects non-alphanumeric characters in the Name field before it reaches the database layer

bash

# Example ModSecurity rule blocking SQL injection on the vulnerable endpoint
SecRule REQUEST_URI "@contains /panel/add-category.php" \
  "id:1006876,phase:2,deny,status:403,\
  chain,msg:'CVE-2025-6876 SQLi attempt on Name parameter'"
  SecRule ARGS:Name "@detectSQLi" \
    "t:none,t:urlDecodeUni"