PT-2026-4967 · Code Projects · Mobile Shop Management System

Published 2026-01-27 · Updated 2026-02-02 · CVE-2025-69564

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions code-projects Mobile Shop Management System version 1.0

Description The software contains a SQL Injection flaw in the '/ExAddNewUser.php' component. The following parameters are susceptible: Name, Address, email, UserName, Password, confirm password, Role, Branch, and Activate. This allows for potential unauthorized access or manipulation of the database.

Recommendations Apply input validation and parameterized queries to the '/ExAddNewUser.php' component to prevent SQL Injection attacks. Sanitize the Name, Address, email, UserName, Password, confirm password, Role, Branch, and Activate parameters before using them in database queries.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-69564

Affected Products

Mobile Shop Management System

References · 6

• 🔥 https://gitee.com/Z_180yc/zyy/issues/IDCEJP · Exploit
• https://osv.dev/vulnerability/CVE-2025-69564 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69564 · Security Note
• https://twitter.com/CVEnew/status/2016185622625652868 · Twitter Post
• https://gist.github.com/lih28984-commits/87eacfc32186020a04e03a2af448723f · Note
• https://t.me/cveNotify/150637 · Telegram Post