CVE-2025-46192

Published May 9, 2025

Last updated 12 hours ago

SourceCodester

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-46192 is a vulnerability found in SourceCodester Client Database Management System 1.0. It involves SQL Injection in the `user_payment_update.php` file. The vulnerability can be exploited via the `order_id` POST parameter. The vulnerability allows for potential arbitrary file uploads due to missing file extension checks, MIME type validation, and authentication. This could lead to remote code execution by uploading and accessing malicious PHP files.

Description: SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_payment_update.php via the order_id POST parameter.
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-89

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:lerouxyxchire:client_database_management_system:1.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DFE80DE6-C79F-452F-9523-4EC1F9777DA4"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.