PT-2025-20576 · Unknown · Sourcecodester Client Database Management System

Published 2025-05-09 · Updated 2025-12-27 · CVE-2025-46189

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Client Database Management System version 1.0

Description The software is susceptible to a SQL Injection issue in the 'user order customer update.php' file. The issue occurs through the order id POST parameter. Exploitation of this issue could allow an attacker to inject malicious SQL code, potentially leading to unauthorized access to or modification of the database. The API endpoint involved is 'user order customer update.php'. The vulnerable parameter is order id.

Recommendations SourceCodester Client Database Management System version 1.0: Sanitize or validate the order id POST parameter in the 'user order customer update.php' file to prevent SQL Injection attacks.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-46189

Affected Products

Sourcecodester Client Database Management System

References · 10

• 🔥 https://github.com/x6vrn/mitre/blob/main/CVE-2025-46189.md · Exploit
• 🔥 https://medium.com/@YousefAlotaibi/disclaimer-1699f46cb1a0 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-46189 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46189 · Vendor Advisory
• https://twitter.com/cybercronai/status/1921212468656853472 · Twitter Post
• https://t.me/cvetracker/23495 · Telegram Post
• https://twitter.com/cybercronai/status/1921309657978614235 · Twitter Post
• https://t.me/cvedetector/24969 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1kjxji5/top_10_trending_cves_11052025 · Reddit Post
• https://twitter.com/CVEnew/status/2005031838943691222 · Twitter Post