CVE-2025-10802
📋 TL;DR
CVE-2025-10802 is an SQL injection vulnerability in code-projects Online Bidding System 1.0 that allows remote attackers to execute arbitrary SQL commands via the ID parameter in /administrator/remove.php. This affects all deployments of version 1.0. Attackers can potentially read, modify, or delete database contents.
💻 Affected Systems
- code-projects Online Bidding System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, or remote code execution if database functions allow it.
Likely Case
Unauthorized data access, modification of bidding data, user account compromise, and potential privilege escalation.
If Mitigated
Limited impact if proper input validation, parameterized queries, and database permissions are implemented.
🎯 Exploit Status
Exploit details are publicly available on GitHub. The vulnerability requires administrator access to reach the vulnerable endpoint, but SQL injection can potentially bypass authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider implementing parameterized queries in remove.php, specifically sanitizing the ID parameter before database operations.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation to ensure ID parameter contains only numeric values
Modify /administrator/remove.php to validate $_GET['ID'] or $_POST['ID'] is numeric before processing
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the remove.php endpoint
Configure WAF to block requests containing SQL keywords (SELECT, UNION, etc.) in ID parameter
🧯 If You Can't Patch
- Restrict access to /administrator/ directory using IP whitelisting or network segmentation
- Implement database user with minimal privileges (read-only if possible) for the application
🔍 How to Verify
Check if Vulnerable:
Test by sending SQL injection payloads to /administrator/remove.php?ID=1' OR '1'='1Check Version:
Check project documentation or source code comments for version informationVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error messages📡 Detection & Monitoring
Log Indicators:
- Multiple requests to /administrator/remove.php with unusual ID parameters
- Database error logs showing SQL syntax errors
Network Indicators:
- HTTP requests containing SQL keywords in URL parameters
- Unusual database query patterns from web server
SIEM Query:
source="web_logs" AND uri_path="/administrator/remove.php" AND (query_string="*SELECT*" OR query_string="*UNION*" OR query_string="*OR*'1'='1*")