PT-2025-20577 · Sourcecodester · Sourcecodester Client Database Management System

Published 2025-05-09 · Updated 2025-12-27 · CVE-2025-46190

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Client Database Management System version 1.0

Description SourceCodester Client Database Management System version 1.0 is susceptible to a SQL Injection issue in the 'user delivery update.php' file. The issue is triggered through the order id POST parameter. Successful exploitation could allow an attacker to manipulate database queries.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the 'user delivery update.php' file. Sanitize the order id POST parameter before using it in database queries.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-46190

Affected Products

Sourcecodester Client Database Management System

References · 10

• 🔥 https://github.com/x6vrn/mitre/blob/main/CVE-2025-46190.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-46190 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46190 · Security Note
• https://twitter.com/cybercronai/status/1921301981437538784 · Twitter Post
• https://twitter.com/cybercronai/status/1921212468656853472 · Twitter Post
• https://twitter.com/CVEnew/status/2005031839803560009 · Twitter Post
• https://t.me/cvetracker/23502 · Telegram Post
• https://t.me/cvedetector/24955 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1kjxji5/top_10_trending_cves_11052025 · Reddit Post
• https://invicti.com/learn/blind-sql-injection · Note