CVE-2025-10967

Vulnerability

Overview

CVE-2025-10967 describes a SQL injection vulnerability in the PHP User Management System, a project hosted on GitHub by MuFen-mker. The flaw resides in the /chkuser.php file, where the username POST parameter is directly concatenated into SQL queries without proper sanitization or parameterization. This root cause allows an attacker to inject arbitrary SQL commands by manipulating the username value [1].

Exploitation

The vulnerability is remotely exploitable without any authentication. An attacker can send a crafted POST request to /chkuser.php with a malicious username parameter. The provided proof-of-concept demonstrates a boolean-based blind SQL injection payload that can be used to extract information from the database [1]. No special privileges or network position is required beyond network access to the application.

Impact

Impact

Successful exploitation enables an attacker to perform unauthorized database operations, including reading, modifying, or deleting sensitive data. This can lead to full database compromise, data leakage, and potential system control. The impact is rated as High with a CVSS v3 score of 7.3, reflecting the ease of exploitation and the severity of potential data breaches [1].

Mitigation

The vendor was contacted but did not respond. The project uses a rolling release model, and no specific patched version has been identified. Users should apply input validation and parameterized queries to the username parameter in /chkuser.php as a workaround. Given the public availability of exploit details, immediate remediation is strongly recommended [1].