PT-2025-45596 · Sourcecodester · Sourcecodester Survey Application System

Lakshay12311 · Published 2025-11-10 · Updated 2025-11-14 · CVE-2025-12929

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Survey Application System version 1.0

Description A flaw exists in the SourceCodester Survey Application System that allows for SQL injection. This occurs through manipulation of the fullname argument within the save user/update user function located in the /LoginRegistration.php file. The attack can be performed remotely. The exploit has been published. Other parameters may also be affected.

Recommendations Apply any available updates to address the SQL injection issue in the save user/update user function of the /LoginRegistration.php file. As a temporary workaround, restrict or sanitize the fullname argument to prevent SQL injection attacks. Review and sanitize all other parameters used in the save user/update user function to mitigate potential vulnerabilities.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-12929

Affected Products

Sourcecodester Survey Application System

References · 11

• 🔥 https://github.com/lakshayyverma/CVE-Discovery/blob/main/Survey%20Application%20System.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12929 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12929 · Vendor Advisory
• https://twitter.com/cracbot/status/1989287249478099320 · Twitter Post
• https://t.me/CVEtracker/36893 · Telegram Post
• https://vuldb.com/?submit.681746 · Note
• https://vuldb.com/?id.331649 · Note
• https://twitter.com/CVEnew/status/1987729276636897378 · Twitter Post
• https://vuldb.com/?ctiid.331649 · Note
• https://sourcecodester.com · Note
• https://t.me/cveNotify/142242 · Telegram Post