CVE Alert: CVE-2025-10459 – PHPGurukul – Beauty Parlour Management System

Risk verdict

High risk: remote unauthenticated SQL injection with a publicly released PoC; urgent patching advised.

Why this matters

The flaw allows unauthenticated attackers to read, alter or exfiltrate data from the backend, potentially impacting customer records and appointment data. With automated tooling and a public PoC, sustained exploitation could lead to data loss, service disruption, or reputational damage for affected businesses.

Most likely attack path

An attacker can target the web-facing admin endpoint over the network, exploiting the delid parameter without authentication. The lack of privilege requirements (PR:N) and no user interaction (UI:N) enable automated SQL injection attempts, with scope kept to the application’s data layer, risking data exposure and integrity. If the app shares DB credentials with the web tier, deeper compromise or lateral movement becomes more feasible.

Who is most exposed

Web-based management systems used by small businesses are especially at risk when their admin interfaces are internet-facing and lack input sanitisation or a WAF. Deployments that rely on default or minimal isolation between web and database layers are particularly vulnerable.

Detection ideas

• Anomalous requests to all-appointment.php with suspicious delid values.
• Database errors or unusual large result sets in web/app logs.
• IDS/IPS alerts for SQL injection payloads targeting PHP-generated queries.
• Unusual DB connection activity from the web server.
• Public PoC-related traffic patterns or automated scanning signatures.

Mitigation and prioritisation

• Apply patch/update from the vendor; treat as priority while patching.
• If patching is delayed, implement input validation and switch to parameterised queries; use prepared statements.
• Enforce least-privilege DB access for the web user; disable detailed error messages; implement a web application firewall with SQLi rules.
• Network segmentation and disable direct internet access to the admin endpoint where feasible.
• Plan a staged rollout, with monitoring for anomalous DB activity post-deployment; reassess risk once patch/mitigations are in place.