CVE-2025-10426

SQL

Injection in Login Page

The Online Laundry Management System 1.0, developed by itsourcecode, contains a SQL injection vulnerability in the /login.php file. The root cause is insufficient validation of the username POST parameter, which is directly concatenated into SQL queries without sanitization [1]. This allows an attacker to inject arbitrary SQL statements through the username input field.

Attack

Vector

This vulnerability is remotely exploitable and requires no authentication [1]. An attacker can submit a crafted POST request to /login.php containing malicious SQL payloads in the username field. Public proof-of-concept (POC) exploit code has been released, demonstrating the ability to perform boolean-based blind SQL injection [1]. The attack surface is exposed to any network reachable to the application.

Impact

Successful exploitation grants the attacker unauthorized access to the underlying database. This can lead to sensitive data leakage, data modification or deletion, and potentially full system compromise [1]. The impact is severe for business continuity and data integrity, as the application's database can be fully controlled by the attacker.

Mitigation

As of this publication, no official patch or fixed version has been released. The vendor's website (https://campcodes.com) hosts the source code, but no advisory or update is yet available [2]. System administrators should immediately apply input validation and parameterized queries to the login functionality, restrict network access to the application, and monitor for any signs of exploitation.