CVE-2025-1162
📋 TL;DR
A critical SQL injection vulnerability in code-projects Job Recruitment 1.0 allows remote attackers to manipulate database queries through the userhash parameter in /_parse/load_user-profile.php. This can lead to unauthorized data access, modification, or deletion. All deployments of Job Recruitment 1.0 with the vulnerable file accessible are affected.
💻 Affected Systems
- code-projects Job Recruitment
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, account takeover, and potential remote code execution if database permissions allow.
Likely Case
Unauthorized access to sensitive user data (personal information, credentials), database manipulation, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
Exploit details are publicly available in GitHub repository. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check vendor website for security updates. 2. If no patch available, implement workarounds. 3. Consider replacing with alternative software if vendor is unresponsive.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd proper input validation and parameterized queries to the vulnerable PHP file
Edit /_parse/load_user-profile.php to use prepared statements with PDO or mysqli
File Access Restriction
allRestrict access to the vulnerable file using web server configuration
Add 'Deny from all' to .htaccess for /_parse/ directory (Apache)
Use nginx location block to deny access to /_parse/ (Nginx)
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns targeting the userhash parameter
- Isolate the application in a segmented network zone with strict outbound database access controls
🔍 How to Verify
Check if Vulnerable:
Check if /_parse/load_user-profile.php exists and contains unsanitized userhash parameter usage. Test with SQL injection payloads in userhash parameter.Check Version:
Check application files for version information, typically in README or configuration filesVerify Fix Applied:
Test the userhash parameter with SQL injection payloads after applying fixes. Verify no database errors or unexpected behavior occurs.📡 Detection & Monitoring
Log Indicators:
- Unusual database query patterns
- SQL syntax errors in web server logs
- Multiple requests to /_parse/load_user-profile.php with suspicious parameters
Network Indicators:
- Unusual outbound database connections from web server
- Patterns of SQL keywords in HTTP requests
SIEM Query:
source="web_logs" AND (uri="/_parse/load_user-profile.php" AND (param="userhash" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|--|#|/*)"))