CVE-2025-15186
📋 TL;DR
This SQL injection vulnerability in Refugee Food Management System 1.0 allows attackers to manipulate database queries through the 'a' parameter in /home/addusers.php. Attackers can potentially access, modify, or delete sensitive data in the database. Organizations using this software are affected.
💻 Affected Systems
- Refugee Food Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive refugee data, user credentials, and food management records.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploit details are publicly disclosed on GitHub and vuldb.com, making weaponization straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider workarounds or replacing the software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameter validation and SQL injection protection to /home/addusers.php
Modify PHP code to use prepared statements with parameterized queries
Access Restriction
linuxRestrict access to vulnerable endpoint using web server configuration
Add 'Deny from all' to .htaccess for /home/addusers.php directory
🧯 If You Can't Patch
- Implement WAF rules to block SQL injection patterns targeting /home/addusers.php
- Isolate the system from internet access and restrict to internal network only
🔍 How to Verify
Check if Vulnerable:
Check if /home/addusers.php exists and accepts 'a' parameter without proper input validation.Check Version:
Check software documentation or configuration files for version information.Verify Fix Applied:
Test SQL injection attempts against the parameter to confirm they're blocked or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts from addusers.php
Network Indicators:
- HTTP requests to /home/addusers.php with SQL injection payloads in parameters
SIEM Query:
source="web_logs" AND uri="/home/addusers.php" AND (param="a" AND value MATCHES "(?i)(union|select|insert|delete|drop|--|#)")