PT-2025-35379 · Sourcecodester · Simple Cafe Billing System

Xyz123 · Published 2025-08-30 · Updated 2025-09-04 · CVE-2025-9702

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Cafe Billing System version 1.0

Description A SQL injection issue exists in SourceCodester Simple Cafe Billing System 1.0. The vulnerability is located in the /sales report.php file, affecting an unknown function. Manipulation of the month argument can lead to SQL injection. The exploit is publicly available and may be used to initiate attacks remotely.

Recommendations As a temporary workaround, consider restricting access to the /sales report.php file until a fix is available.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-9702

Affected Products

Simple Cafe Billing System

References · 11

• 🔥 https://github.com/0510green-hand/cve/issues/5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9702 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9702 · Vendor Advisory
• https://vuldb.com/?ctiid.321924 · Note
• https://vuldb.com/?submit.639224 · Note
• https://t.me/CVEtracker/31342 · Telegram Post
• https://vuldb.com/?id.321924 · Note
• https://sourcecodester.com · Note
• https://twitter.com/cracbot/status/1963557708184850569 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1961876593107685783 · Twitter Post
• https://twitter.com/CVEnew/status/1961872588214264002 · Twitter Post