CVE-2026-37431: Beauty Parlour Management System SQLi

CVE-2026-37431 Overview

CVE-2026-37431 is a SQL injection vulnerability in Beauty Parlour Management System v1.1. The flaw exists in the /appointment-detail.php endpoint, where the aptnumber parameter is concatenated into a SQL query without proper sanitization. An unauthenticated remote attacker can inject crafted SQL statements to read, modify, or extract data from the backend database. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated network-based SQL injection enabling full database compromise, including confidentiality, integrity, and availability of stored records.

Affected Products

Beauty Parlour Management System v1.1
/appointment-detail.php endpoint
aptnumber request parameter

Discovery Timeline

2026-05-08 - CVE-2026-37431 published to NVD
2026-05-08 - Last updated in NVD database

Technical Details for CVE-2026-37431

Vulnerability Analysis

The Beauty Parlour Management System is a PHP-based web application that manages appointments, customers, and service records. The /appointment-detail.php script accepts the aptnumber parameter via HTTP request and incorporates the value directly into a SQL query string. Because user-supplied input is not parameterized or escaped, attackers can break out of the intended query context and append arbitrary SQL syntax.

Exploitation requires no authentication and no user interaction. An attacker with network access to the application can send a single crafted HTTP request to retrieve database contents, including administrative credentials, customer personal information, and appointment records.

Root Cause

The root cause is direct string concatenation of untrusted input into a SQL statement. The application does not use prepared statements or parameter binding when querying appointment data using the aptnumber value. Standard PHP database APIs such as PDO with bound parameters or mysqli_prepare are not applied to this code path.

Attack Vector

The attack is delivered over the network against the vulnerable /appointment-detail.php endpoint. An attacker supplies a malicious aptnumber value containing SQL metacharacters and UNION-based or boolean-based payloads. The backend database executes the injected query and returns results that disclose sensitive information. Public proof-of-concept material is available in the GitHub PoC repository, which documents the exploitation request format.

Detection Methods for CVE-2026-37431

Indicators of Compromise

HTTP requests to /appointment-detail.php containing SQL metacharacters such as ', --, UNION SELECT, or OR 1=1 in the aptnumber parameter.
Web server logs showing unusually long aptnumber values or encoded payloads (%27, %20UNION%20).
Database error messages referencing syntax errors originating from appointment queries.
Unexpected outbound data transfer from the web server following requests to the appointment endpoint.

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects the aptnumber parameter for SQL injection signatures and known UNION-based payload structures.
Enable database query logging and alert on appointment-related queries containing tautologies or stacked statements.
Correlate web access logs with database audit logs to identify single requests that trigger high-volume row reads.

Monitoring Recommendations

Monitor authentication tables for unexpected reads or credential exfiltration patterns.
Track HTTP 500 responses from /appointment-detail.php as potential injection probing.
Alert on access from non-business geographies or anonymizing proxy networks to the appointment endpoint.

How to Mitigate CVE-2026-37431

Immediate Actions Required

Restrict network access to the Beauty Parlour Management System until the vulnerable endpoint is remediated.
Apply WAF rules that block SQL injection payloads targeting the aptnumber parameter.
Audit database accounts used by the application and rotate credentials if exposure is suspected.
Review web and database logs for prior exploitation attempts referenced in the indicators above.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2026-37431 at the time of publication. Operators should refer to the project source for code-level fixes and replace string concatenation with parameterized queries. The proof-of-concept and technical details are documented in the GitHub PoC SQL Injection reference.

Workarounds

Place the application behind a reverse proxy or WAF that enforces strict input validation on the aptnumber parameter, allowing only numeric values.
Apply database-level least privilege so the application account cannot read sensitive tables or execute administrative statements.
Disable the /appointment-detail.php endpoint if it is not required for business operations.

bash

# Example WAF rule (ModSecurity) to block SQLi in aptnumber
SecRule ARGS:aptnumber "@rx (?i)(union(\s|/\*.*\*/)+select|or\s+1=1|--|;|/\*|\bxp_)" \
    "id:1037431,phase:2,deny,status:403,log,msg:'CVE-2026-37431 SQLi attempt on aptnumber'"

# Enforce numeric-only aptnumber values at the proxy layer
SecRule ARGS:aptnumber "!@rx ^[0-9]+$" \
    "id:1037432,phase:2,deny,status:400,log,msg:'Non-numeric aptnumber rejected'"