CVE-2025-11074

Vulnerability

Analysis

CVE-2025-11074 is a SQL injection flaw in code-projects Project Monitoring System 1.0, specifically within the /login.php file. The root cause is the direct concatenation of user-supplied username and password parameters into SQL queries without proper sanitization or parameterization [1]. This allows an attacker to inject arbitrary SQL commands.

Exploitation

The attack can be initiated remotely without authentication, as the login page is publicly accessible [1]. A malicious HTTP POST request to /project/pmmp/login.php?action=login with crafted values in the username and password fields can trigger the injection. A public proof-of-concept (PoC) demonstrates retrieving database information via a simple payload [1]. The vulnerability can be exploited with standard HTTP tools, requiring no special network position beyond network access to the application.

Impact

Successful exploitation enables an attacker to manipulate backend SQL queries, potentially leading to unauthorized data access, credential retrieval, or escalation to server compromise [1]. As the PoC shows, database enumeration is possible, which could expose sensitive user data or application secrets.

Mitigation

As of publication, the vendor (code-projects) has not released a patch [2]. The application source code is available, but no advisory or fix has been issued. Until a patch is applied, input validation and prepared statements should be implemented, and the system should be isolated if exposed to untrusted networks.