CVE-2025-6877: Salon Management System SQLi Vulnerability

CVE-2025-6877 Overview

CVE-2025-6877 is a SQL injection vulnerability in SourceCodester Best Salon Management System 1.0. The flaw resides in /panel/edit-category.php, where the editid parameter is passed directly into a database query without proper sanitization. Authenticated attackers can manipulate the parameter remotely to inject arbitrary SQL syntax. The vulnerability has been publicly disclosed, increasing the likelihood of opportunistic exploitation against exposed installations. The product is developed by Mayurik and distributed through SourceCodester. The issue is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote SQL injection through the editid parameter in /panel/edit-category.php allows attackers to read, modify, or destroy salon management database contents.

Affected Products

Mayurik Best Salon Management System 1.0
SourceCodester distributions of Best Salon Management System
Deployments using the vulnerable /panel/edit-category.php endpoint

Discovery Timeline

2025-06-30 - CVE-2025-6877 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-6877

Vulnerability Analysis

The vulnerability exists in the category editing workflow of the administration panel. The /panel/edit-category.php script accepts an editid HTTP parameter that identifies the category record to be modified. The application concatenates this value directly into a SQL statement without parameterized queries or input validation. Attackers with low-privileged panel access can append SQL syntax to the parameter and alter the structure of the executed query.

Successful exploitation allows extraction of arbitrary database tables, including customer records, staff accounts, and stored credentials. Attackers can also modify or delete records, escalating impact beyond data disclosure. The exploit details have been disclosed publicly via VulDB and a GitHub writeup, lowering the barrier for attackers.

Root Cause

The root cause is improper neutralization of user-supplied input before incorporating it into SQL statements. The application uses direct string concatenation rather than prepared statements with bound parameters. No type casting, allowlist validation, or escaping is applied to the editid value before query execution.

Attack Vector

The attack is delivered over the network against an authenticated panel session. An attacker submits a crafted HTTP request to /panel/edit-category.php with a malicious editid value containing SQL metacharacters such as ', UNION SELECT, or boolean conditions. Refer to the GitHub SQL Injection Guide and VulDB entry 314349 for technical details on the exploitation payload.

Detection Methods for CVE-2025-6877

Indicators of Compromise

HTTP requests to /panel/edit-category.php containing SQL metacharacters such as ', ", --, UNION, or SLEEP( in the editid parameter.
Unexpected database errors or long response times correlated with requests to the category edit endpoint.
New or modified administrator records, or unauthorized changes to category tables, without matching legitimate administrative activity.

Detection Strategies

Inspect web server access logs for non-numeric values in the editid query string parameter, since legitimate use submits integer identifiers.
Deploy web application firewall (WAF) rules that flag SQL injection patterns targeting PHP admin panels.
Correlate authentication events with anomalous query volumes against MySQL or MariaDB backends used by the application.

Monitoring Recommendations

Centralize PHP application and database logs to identify error spikes such as SQLSTATE or syntax errors triggered by injection attempts.
Alert on outbound data transfers from the database server that exceed normal baselines, indicating possible mass extraction.
Monitor administrative account creation, password changes, and privilege updates in the application database.

How to Mitigate CVE-2025-6877

Immediate Actions Required

Restrict network access to the /panel/ administrative directory using IP allowlists or VPN-only access.
Audit existing administrator accounts and rotate credentials, since low-privileged accounts can exploit the flaw.
Review database logs for evidence of prior exploitation against the edit-category.php endpoint.

Patch Information

No official vendor patch has been published for Best Salon Management System 1.0 at the time of disclosure. Operators should monitor SourceCodester and the Mayurik project page for updates. Until a fix is released, apply the workarounds below and consider replacing the application with a maintained alternative.

Workarounds

Modify /panel/edit-category.php to cast editid to an integer using intval() before using it in any query.
Refactor database calls to use prepared statements with bound parameters via PDO or MySQLi.
Deploy a WAF rule blocking SQL metacharacters in the editid parameter as a temporary virtual patch.
Disable the affected endpoint if the category edit functionality is not required in production.

bash

# Configuration example
# Example ModSecurity rule to block SQLi attempts against editid
SecRule ARGS:editid "@rx [^0-9]" \
  "id:1006877,phase:2,deny,status:403,\
  msg:'CVE-2025-6877: Non-numeric editid in edit-category.php',\
  tag:'sql-injection',tag:'CVE-2025-6877'"