CVE-2025-10806 – This SQL injection vulnerability in Campcodes O... (How to Fix)

Q: What is the severity of CVE-2025-10806?

CVE-2025-10806 has a CVSS score of 6.3 (MEDIUM). This SQL injection vulnerability in Campcodes Online Beauty Parlor Management System 1.0 allows attackers to manipulate database queries through the fromdate/todate parameters in the admin interface. Organizations using this specific software version are affected, particularly those with internet-facing installations. Successful exploitation could lead to unauthorized data access or system compromise.

📋 TL;DR

This SQL injection vulnerability in Campcodes Online Beauty Parlor Management System 1.0 allows attackers to manipulate database queries through the fromdate/todate parameters in the admin interface. Organizations using this specific software version are affected, particularly those with internet-facing installations. Successful exploitation could lead to unauthorized data access or system compromise.

💻 Affected Systems

Products:

Campcodes Online Beauty Parlor Management System

Versions: 1.0

Operating Systems: Any OS running the web application

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability exists in the default installation via the /admin/bwdates-reports-details.php endpoint

📦 What is this software?

Online Beauty Parlor Management System by Campcodes

View all CVEs affecting Online Beauty Parlor Management System →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise leading to data theft, privilege escalation, or system takeover

🟠

Likely Case

Unauthorized access to sensitive customer and business data stored in the database

🟢

If Mitigated

Limited impact with proper input validation and database permissions in place

🌐 Internet-Facing: HIGH - Attack can be initiated remotely without authentication

🏢 Internal Only: MEDIUM - Still vulnerable but requires internal network access

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploit details are publicly available on GitHub, requiring admin access but with known attack vectors

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: UNKNOWN

Vendor Advisory: https://www.campcodes.com/

Restart Required: No

Instructions:

No official patch available. Implement input validation and parameterized queries in the affected PHP file.

🔧 Temporary Workarounds

Input Validation and Sanitization

all

Add proper input validation and sanitization for fromdate/todate parameters

Edit /admin/bwdates-reports-details.php to implement parameterized queries or input filtering

Web Application Firewall

all

Deploy WAF with SQL injection protection rules

🧯 If You Can't Patch

Restrict access to /admin/ directory to trusted IP addresses only
Implement database user with minimal required permissions

🔍 How to Verify

Check if Vulnerable:

Test the /admin/bwdates-reports-details.php endpoint with SQL injection payloads in fromdate/todate parameters

Check Version:

Check software version in admin panel or configuration files

Verify Fix Applied:

Verify that SQL injection attempts no longer succeed and input validation is properly implemented

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries in database logs
Multiple failed login attempts to admin interface
Suspicious parameter values in web server logs

Network Indicators:

SQL injection patterns in HTTP requests to /admin/bwdates-reports-details.php

SIEM Query:

source="web_server" AND uri="/admin/bwdates-reports-details.php" AND (param="fromdate" OR param="todate") AND (value="' OR" OR value="--" OR value="UNION")

📊 Metadata

CVE ID: CVE-2025-10806

CVSS v3 Score: 6.3 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE: CWE-74

EPSS Score: 0.05% exploit probability (14.9th percentile)

Published: September 22, 2025

Last Updated: September 24, 2025

🔗 References

https://github.com/fubxx/CVE/blob/main/Online%20Beauty%20Parlor%20Management%20System%20SQL%20Injection%20on%20bwdates-reports-details.php%20.md Exploit,Third Party Advisory
https://vuldb.com/?ctiid.325164 Permissions Required,VDB Entry
https://vuldb.com/?id.325164 Third Party Advisory,VDB Entry
https://vuldb.com/?submit.654375 Third Party Advisory,VDB Entry
https://www.campcodes.com/ Product
https://github.com/fubxx/CVE/blob/main/Online%20Beauty%20Parlor%20Management%20System%20SQL%20Injection%20on%20bwdates-reports-details.php%20.md Exploit,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-10806, you might also want to check these: