CVE-2025-10973

Vulnerability

Overview

A SQL injection flaw has been identified in the userid parameter of /admin/show.php in the PHP Resume Management System (Resume-management-system by JackieDYH). The root cause is insufficient validation of user-supplied input, which is directly concatenated into SQL queries without proper sanitization. This allows an attacker to inject malicious SQL statements via the userid parameter [1].

Exploitation

Prerequisites

The attack is remotely exploitable over HTTP and requires no authentication or prior authorization. An attacker only needs to send a crafted HTTP GET request to the vulnerable endpoint with a malicious userid value. Proof-of-concept (PoC) code has been published, and the exploit is considered active [1].

Impact

Successful exploitation can lead to unauthorized database access, extraction of sensitive data (e.g., user credentials, resume details), data modification or deletion, and potentially full system compromise. The vulnerability also enables time-based blind SQL injection, which can be used to enumerate database contents even without visible error output [1].

Mitigation

Status

The vendor was contacted but did not respond. The software uses a rolling release model, and no specific patched version has been announced. As of the disclosure date, the vulnerability remains unaddressed, and administrators are advised to restrict access to the admin panel or remove the vulnerable script until a fix is applied [1].