CVE-2025-11608

Vulnerability

Overview

A security flaw was discovered in the code-projects E-Banking System version 1.0 within the register.php script. The POST Parameter Handler fails to sanitize user supplied input for the username and password arguments, leading to SQL injection. The issue stems from insufficient validation or escaping of these parameters before inclusion in database queries.

Exploitation

Details

The attack is remotely exploitable without requiring authentication. An attacker can manipulate the username or password fields to inject arbitrary SQL statements. The exploit is publicly available, lowering the barrier for potential exploitation. Because the endpoint is the registration page, it is accessible from the internet in typical deployments, increasing the likelihood of targeting.

Impact

Successful exploitation could allow an attacker to retrieve sensitive data from the database, such as user credentials, personal information, or financial records. Depending on database privileges, an attacker might also be able to modify or delete data. Given the CVSS v3 base score of 7.3 (High), the vulnerability poses a significant risk to the confidentiality, integrity, and availability of the system [1].

Mitigation

Status

At the time of disclosure, no official patch has been released by code-projects for version 1.0. Users are advised to apply strict input validation on all POST parameters, use parameterized queries, and consider disabling the registration page if not required. Organizations should evaluate their exposure and implement virtual patching or Web Application Firewall (WAF) rules to block injection attempts.