PT-2025-42760 · Unknown · Bhabishya-123 E-Commerce

Published 2025-10-20 · Updated 2025-10-20 · CVE-2025-61455

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bhabishya-123 E-commerce version 1.0

Description A SQL Injection issue exists in Bhabishya-123 E-commerce. The application incorporates unsanitized user inputs directly into SQL queries. This allows unauthenticated attackers to bypass authentication and gain full access. The vulnerability is present in the signup.inc.php endpoint and the https://t.co/ox4NNwmsS5.php endpoint. The signup.inc.php endpoint directly incorporates unsanitized user inputs into SQL queries.

Recommendations Sanitize all user inputs before incorporating them into SQL queries in the signup.inc.php endpoint. Sanitize all user inputs before incorporating them into SQL queries in the https://t.co/ox4NNwmsS5.php endpoint.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-61455

Affected Products

Bhabishya-123 E-Commerce

References · 4

• 🔥 https://github.com/tansique-17/CVE-2025-61455 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-61455 · Security Note
• https://t.me/cveNotify/139390 · Telegram Post
• https://twitter.com/CVEnew/status/1980270958179942893 · Twitter Post