CVE Alert: CVE-2025-9645 – itsourcecode – Apartment Management System

Risk verdict

High risk: publicly exploitable SQL injection with remote access via itsourcecode Apartment Management System r_all_info.php, with a PoC available.

Why this matters

Unauthenticated remote exploitation can lead to data exfiltration, data tampering, or possible temporary service disruption. Given the PoC and automatable exploit, any internet-facing instance of this product is a credible target, elevating risk to organisations handling tenant or management data.

Most likely attack path

Attacker targets the mid parameter in r_all_info.php over the network without user interaction or credentials. A successful injection could read or modify database contents, potentially leaking sensitive information or tampering records. Lateral movement is plausible if the DB user privileges are broad or the app uses a single DB account for multiple modules; preconditions are minimal (network access, no UI interaction).

Who is most exposed

Sites hosting the web-based Apartment Management System (on-premises or hosted) exposed to the public internet or poorly firewalled DMZs are at greatest risk; small/medium organisations using default deployments or shared hosting are particularly vulnerable.

Detection ideas

• Look for unusual or error-laden SQL responses in application logs.
• Monitor for anomalous requests featuring unusual mid values or SQL syntax patterns.
• Detect repeated access from a single source targeting r_all_info.php.
• Correlate spikes in DB query latency with specific endpoints.
• Watch for data access patterns consistent with local data enumeration.

Mitigation and prioritisation

• Apply the vendor patch or upgrade to fixed version; prioritise patching now.
• Implement parameterised queries and prepared statements; remove dynamic SQL.
• WAF rules to block SQLi patterns on the mid parameter; tighten input validation.
• Restrict DB privileges for the application user (least privilege; separate read/write accounts).
• Disable verbose error messages and sanitise error reporting; ensure proper logging and alerting.
• If KEV or EPSS presence becomes known, adjust to priority 1 accordingly.