Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-11662: SQL Injection in SourceCodester Best Salon Management System booking.php

CVE-2025-11662 · published 1 year ago

Summary

An attacker can inject malicious SQL code into the SourceCodester Best Salon Management System's booking feature, potentially allowing them to access or modify sensitive data. This issue allows for remote attacks, and exploit code is already available. Update the system to a fixed version or apply a patch to prevent unauthorized access.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
mayurik	best_salon_management_system	1.0 `cpe:2.3:a:mayurik:best_salon_management_system:1.0:::::::*`

Original advisory text

A security flaw has been discovered in SourceCodester Best Salon Management System 1.0. Impacted is an unknown function of the file /booking.php. The manipulation of the argument serv_id results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.

References

https://github.com/Scorbunny2/Best-salon-management-system-SQL-injection Exploit Third Party Advisory
https://vuldb.com/?ctiid.328081 Permissions Required VDB Entry
https://vuldb.com/?id.328081 Third Party Advisory VDB Entry
https://vuldb.com/?submit.672847 Third Party Advisory VDB Entry
https://www.sourcecodester.com/ Product

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-74Injection

CWE-89SQL Injection

Timeline

Published13 Oct 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-11662 · NVD

Track software like this

Free during beta