CVE-2025-10087
📋 TL;DR
This SQL injection vulnerability in SourceCodester Pet Grooming Management Software 1.0 allows attackers to manipulate database queries through the product_id parameter in /admin/profit_report.php. Attackers can potentially access, modify, or delete database content remotely. Organizations using this specific software version are affected.
💻 Affected Systems
- SourceCodester Pet Grooming Management Software
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive data theft, administrative account takeover, and potential system destruction
Likely Case
Data exfiltration of customer/pet information, financial records, and business operations data
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-sensitive data
🎯 Exploit Status
Exploit requires access to admin interface but has been publicly disclosed with technical details
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider replacing with alternative software or implementing custom fixes.
🔧 Temporary Workarounds
Input Validation and Parameterized Queries
PHPImplement proper input validation and use prepared statements for database queries
Modify /admin/profit_report.php to use PDO or mysqli prepared statements
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns
Add WAF rule: deny requests with SQL keywords in product_id parameter
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement network segmentation to limit database access from web server
🔍 How to Verify
Check if Vulnerable:
Test /admin/profit_report.php with SQL injection payloads in product_id parameterCheck Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from web server
- Multiple failed login attempts to admin panel
- SQL syntax errors in application logs
Network Indicators:
- HTTP requests to /admin/profit_report.php with SQL keywords in parameters
- Unusual database traffic patterns
SIEM Query:
source="web_logs" AND uri="/admin/profit_report.php" AND (param="product_id" AND value CONTAINS "UNION" OR "SELECT" OR "INSERT" OR "DELETE")