CVE-2025-9150

Vulnerability

Overview

A SQL injection vulnerability exists in the Surbowl dormitory-management-php project, specifically in the file /admin/violation_add.php?id=2. The root cause is the lack of input validation and sanitization on the id GET parameter, which is directly concatenated into SQL queries. This allows an attacker to inject malicious SQL statements by manipulating the id parameter [1].

Exploitation

The attack can be performed remotely without any authentication. An attacker simply sends a crafted HTTP GET request to the vulnerable endpoint with a malicious id value. For example, a time-based blind SQL injection payload such as id=2 AND (SELECT 2331 FROM (SELECT(SLEEP(5)))ClgD) can be used to extract information from the database [1]. No special privileges or network position is required.

Impact

Successful exploitation enables an attacker to gain unauthorized access to the underlying database. This can lead to sensitive data leakage, data tampering, and potentially full system compromise. The impact is severe as it threatens the confidentiality, integrity, and availability of the application and its data [1].

Mitigation

The product uses a rolling release model, and version information for affected or fixed releases is not disclosed. However, the vulnerability only affects versions that are no longer supported by the maintainer. Users are advised to discontinue use of unsupported versions or upgrade to a supported release if available. No official patch has been announced, and the exploit is publicly available [1].