CVE-2025-11585

Vulnerability

Overview

A SQL injection vulnerability exists in the Project Monitoring System version 1.0, specifically within the /useredit.php file. The root cause is the lack of proper sanitization or validation of the uid parameter, which is directly incorporated into SQL queries [1]. This allows an attacker to inject arbitrary SQL statements by manipulating the uid input.

Exploitation

Details

The attack can be performed remotely without any authentication or authorization [1]. An attacker sends a crafted POST request to /useredit.php with a malicious uid parameter. The exploit has been publicly disclosed, increasing the risk of widespread exploitation [1].

Impact

Successful exploitation enables an attacker to gain unauthorized access to the underlying database, leading to sensitive data leakage, data tampering, and potential full system compromise [1]. This poses a severe threat to the confidentiality, integrity, and availability of the system and its data.

Mitigation

Status

As of the publication date, no official patch or security update has been released by the vendor (code-projects.org) [2]. Users are advised to implement input validation and parameterized queries as a workaround, or consider migrating to an alternative solution.