CVE-2025-15049
📋 TL;DR
CVE-2025-15049 is a SQL injection vulnerability in code-projects Online Farm System 1.0 that allows attackers to execute arbitrary SQL commands via the Username parameter in /addProduct.php. This affects all users running the vulnerable version of this web application. Remote attackers can potentially access, modify, or delete database content.
💻 Affected Systems
- code-projects Online Farm System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, authentication bypass, and potential server takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized database access leading to sensitive information disclosure, data manipulation, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
Exploit details are publicly available on GitHub and vuldb.com. The vulnerability is in a web-accessible file with no authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check code-projects.org for security updates
2. If no patch available, implement workarounds
3. Consider migrating to alternative software
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation to sanitize Username parameter inputs
Implement parameterized queries or prepared statements in PHP code
Web Application Firewall Rules
allBlock SQL injection patterns targeting /addProduct.php
Add WAF rule: deny requests to /addProduct.php containing SQL keywords in Username parameter
🧯 If You Can't Patch
- Implement network segmentation to isolate the vulnerable system
- Deploy a web application firewall with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Test /addProduct.php endpoint with SQL injection payloads in Username parameterCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Test with SQL injection payloads and verify they are rejected or sanitized📡 Detection & Monitoring
Log Indicators:
- SQL error messages in web server logs
- Multiple failed login attempts with SQL payloads
- Unusual database queries from web application
Network Indicators:
- HTTP POST requests to /addProduct.php containing SQL keywords
- Unusual database connection patterns
SIEM Query:
source="web_server" AND uri="/addProduct.php" AND (payload="UNION" OR payload="SELECT" OR payload="INSERT" OR payload="DELETE")