Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-8947: Visitor Management System SQL Injection Vulnerability Allows Remote Attack

CVE-2025-8947 · published 1 year ago

Summary

A flaw in the Visitor Management System allows hackers to inject malicious SQL code, potentially stealing sensitive data or taking control of the system. This can happen when an attacker manipulates certain date fields in a query. To stay safe, update the system to the latest version and ensure all users have the most recent patches.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
projectworlds	visitor_management_system	1.0 `cpe:2.3:a:projectworlds:visitor_management_system:1.0:::::::*`

Original advisory text

A vulnerability was found in projectworlds Visitor Management System 1.0. This issue affects some unknown processing of the file /query_data.php. The manipulation of the argument dateF/dateP leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

References

https://github.com/guoma-book/CVE/issues/3 Issue Tracking
https://github.com/guoma-book/CVE/issues/4 Issue Tracking
https://vuldb.com/?ctiid.319913 Permissions Required VDB Entry
https://vuldb.com/?id.319913 Third Party Advisory VDB Entry
https://vuldb.com/?submit.631995 Third Party Advisory VDB Entry
https://vuldb.com/?submit.631996 Third Party Advisory VDB Entry

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-74Injection

CWE-89SQL Injection

Timeline

Published14 Aug 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-8947 · NVD

Track software like this

Free during beta