CVE-2025-11357

Executive Summary

CVE-2025-11357 is a SQL injection vulnerability in code-projects Simple Banking System 1.0, affecting the /createuser.php script where manipulation of the Name argument permits injection of arbitrary SQL. The flaw is remotely exploitable by an authenticated user (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, base score 6.3) and a public exploit has been released, though no known in-the-wild exploitation or CISA KEV listing has been recorded as of this writing. Affected deployments are unpatched, exposing user account creation functionality to data tampering, data disclosure, and potential downstream authentication compromise within banking applications.

Technical Analysis

The vulnerability resides in the /createuser.php handler of Simple Banking System 1.0. According to the NVD description, the issue "affects some unknown processing of the file /createuser.php" and is triggered by "manipulation of the argument Name," producing SQL injection. The CNA title reinforces this: "code-projects Simple Banking System createuser.php sql injection."

From a vulnerability-class perspective, this is a classic CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component — Injection), with the specific sub-class being SQL injection. The Name parameter is concatenated into an SQL statement executed by the backend database without proper parameterization or escaping. Because the vulnerable script is /createuser.php, the injection point is almost certainly within a user-creation workflow — the application likely builds an INSERT INTO users (...) statement incorporating the attacker-controlled Name value directly.

The NVD description explicitly enumerates Name as the manipulated argument, but does not disclose the underlying database engine, the exact SQL query construct, the parameter-binding approach (if any), or any secondary injection points. No code snippet, function name, or database schema has been provided by the vendor or NVD. Consequently, the precise statement shape (e.g., string concatenation vs. unsafe prepared-statement usage) cannot be asserted from available data. What can be asserted is the injection class: user-supplied input in the Name field is incorporated into a SQL query, permitting the attacker to alter query semantics.

CVSS 3.1 scoring (AV:N — network attack vector; AC:L — low attack complexity; PR:L — low privileges required; UI:N — no user interaction; S:U — unchanged scope; C:L/I:L/A:L — low confidentiality, integrity, and availability impacts) is consistent with an authenticated SQL injection whose immediate blast radius is bounded to the affected application's database but which does not, on its face, yield unconstrained code execution or privilege escalation to the underlying OS.

No CVSS temporal or environmental metrics are published, and no vendor advisory link is included in the supplied data.

Exploitation Scenarios

No public PoC code was supplied with the intelligence data, and the Nuclei template flag is "NO." The following attack chain is therefore inferred at the vulnerability-class level, based strictly on the NVD description and CVSS vector.

1. Reconnaissance / target identification. An attacker enumerates internet-facing deployments of code-projects Simple Banking System. Given the unpatched status and public exploit availability, scanning for Simple Banking System title banners (http.title:"Simple Banking System") is sufficient for identification. Because PR:L is required, the attacker must first obtain credentials to a low-privileged account — for example, an existing customer or teller account in the same instance.

2. Trigger of the specific flaw. Once authenticated, the attacker navigates to the /createuser.php endpoint — a script normally reserved for creating new accounts or users. In the request (GET or POST, not specified) the attacker supplies a crafted value for the Name argument. The application passes this value into a backend SQL statement without neutralization, causing the injected SQL fragment to execute as part of the original query.

3. Payload / execution method at vulnerability-class level. Because only the injection class is confirmed, the payload itself is described generically: SQL metacharacters (quotes, comments, boolean and UNION constructs, sub-selects) are embedded in the Name parameter to reshape the executed statement. If the surrounding statement is an INSERT, an attacker may attempt to append additional rows or subvert the new-user record's fields (including password/hash or role columns, if present). If any result of the statement is echoed back to the response, UNION-based extraction is also conceivable. Exfiltration of arbitrary database content and alteration of stored records are both within the C/L/I damage band.

4. Post-exploitation impact. Successful exploitation yields low-integrity and low-confidentiality damage per CVSS. Realistic outcomes include insertion of attacker-controlled user records, tampering with existing account data, and disclosure of data reachable by the application's database principal. Because the injection surface is /createuser.php, account-creation abuse (adding rogue accounts) is a plausible immediate objective. No evidence in the supplied data supports DBMS-level privilege escalation or OS command execution, and no such claims should be assumed.

No public exploit-in-the-wild activity, no attribution, and no CISA KEV listing are reported for CVE-2025-11357 at the time of writing.

Impact Assessment

Affected product: code-projects Simple Banking System 1.0 (as stated in the CNA title and NVD description). Affected component: /createuser.php, argument Name. No other versions are enumerated in the source data.

Business impact for banking-sector deployments is material despite the moderate 6.3 base score. An authenticated SQL injection reachable from the account-provisioning workflow can undermine the integrity of the user store (rogue account creation, field tampering), leak data returned through the same handler, and erode availability if injected statements disrupt service. The unchanged-scope metric (S:U) indicates the impact is contained within the vulnerable component rather than crossing a security boundary into the host OS.

Blast radius: any internet-exposed Simple Banking System 1.0 instance that permits authenticated users to reach /createuser.php. Because the CNA has published the vulnerability alongside public exploit availability, exposure pressure is elevated. EPSS is low (0.00332, ~24.3rd percentile), indicating limited modeled near-term exploitation activity, and there is no KEV status — but the unpatched state and public disclosure together justify prioritized mitigation over simple deprioritization based on EPSS alone.

CVSS subscores in context:

• AV:N — remotely reachable over the network.
• AC:L — no significant exploitation preconditions beyond valid credentials.
• PR:L — low privileges (an ordinary authenticated account) suffice.
• UI:N — no victim interaction is required.
• S:U — scope is unchanged.
• C:L / I:L / A:L — bounded but real loss of confidentiality, integrity, and availability.

Detection Guidance

Sigma Rule

title: SQL Injection Attempt Against Simple Banking System createuser.php (CVE-2025-11357)
id: 8f2b7c41-6d4e-4a90-9b31-0a5e3c7d1f22
status: experimental
description: Detects SQL injection patterns targeting the Name parameter of /createuser.php in code-projects Simple Banking System 1.0 (CVE-2025-11357).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-11357
author: valtersit.com Threat Intelligence
date: 2025-01-01
logsource:
  category: webserver
  product: apache
detection:
  selection_endpoint:
    cs-uri-stem|endswith: '/createuser.php'
  selection_payload:
    cs-uri-query|contains:
      - 'UNION'
      - 'SELECT'
      - "' OR "
      - "' AND "
      - '--'
      - '/*'
      - 'SLEEP('
      - 'BENCHMARK('
      - 'WAITFOR'
  condition: selection_endpoint and selection_payload
falsepositives:
  - Legitimate names containing apostrophes
  - Application testing or fuzzing in non-production
level: high
tags:
  - attack.t1190
  - attack.initial_access
  - cve.2025.11357

YARA Rule

rule CVE_2025_11357_SQLi_Createuser_Payload
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects SQL injection payloads targeting the Name parameter of /createuser.php (code-projects Simple Banking System 1.0)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-11357"
        date = "2025-01-01"
        severity = "high"

    strings:
        $ep = "createuser.php" nocase
        $name_param = "Name=" nocase
        $sqli1 = "' OR " nocase
        $sqli2 = "' UNION " nocase
        $sqli3 = "SELECT " nocase
        $sqli4 = "--" nocase
        $sqli5 = "SLEEP(" nocase
        $sqli6 = "BENCHMARK(" nocase
        $sqli7 = "INFORMATION_SCHEMA" nocase

    condition:
        $ep and $name_param and any of ($sqli*)
}

Suricata IDS Rule

alert http any any -> any any ( \
  msg:"CVE-2025-11357 SQL Injection Attempt Against Simple Banking System createuser.php (Name param)"; \
  flow:established,to_server; \
  http.uri; content:"/createuser.php"; nocase; \
  http.uri; content:"Name="; nocase; \
  pcre:"/(%27|')(\s)*(or|union|and|select)/i"; \
  reference:cve,2025-11357; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2025-11357; \
  classtype:web-application-attack; \
  sid:2025113057; rev:1; \
  metadata:created_at 2025_01_01, updated_at 2025_01_01; \
)

Elastic Detection

network where
  url.path : "/createuser.php" and
  (
    url.query : ("*' OR *", "*' UNION *", "*-- *", "*SLEEP(*", "*BENCHMARK(*", "*INFORMATION_SCHEMA*", "*WAITFOR*")
  )

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri = coalesce(uri, url, cs_uri_stem, request)
| eval query = coalesce(uri_query, cs_uri_query, orig_query)
| where like(uri, "%createuser.php%")
| where match(query, "(?i)(union\s+select|'\s*(or|and)\s|--\s|/\*|sleep\(|benchmark\(|information_schema|waitfor)")
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as src_ips by uri
| sort - count

Wazuh OSSEC Rule

<group name="web,sql_injection,cve_2025_11357,">
  <rule id="100357" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>createuser.php</url>
    <match>Name=</match>
    <regex>(?i)(%27|')\s*(or|and|union|select)|/\*|--|\bsleep\(|\bbenchmark\(|information_schema|waitfor</regex>
    <description>CVE-2025-11357: SQL injection attempt against Simple Banking System createuser.php (Name parameter)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sql_injection,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, no OSV package data, no tracked patch source, and no workaround were provided in the vulnerability record. Treat any production instance of code-projects Simple Banking System 1.0 as vulnerable until an authoritative patch is published.

1. Immediate mitigations (compensating controls)

• Restrict network access to /createuser.php: enforce strict authentication and role-based access so that only trusted administrative workflows can reach the endpoint. PR:L in the CVSS vector underscores that any authenticated account is sufficient, so privilege containment is essential.
• Add a WAF/reverse-proxy rule that rejects requests to /createuser.php whose Name parameter contains SQL metacharacters (quotes, comment markers, UNION, SELECT, time-delay functions). Deploy the Suricata and Wazuh rules above to alert on attempts.
• Enable verbose web and database query logging and forward logs to the SOC for correlation with the detection signatures supplied above.
• Where the deployment is a training/lab instance rather than a production banking system, ensure it is not internet-exposed. Shodan-exploitable placement of demo code is a recurring exposure vector.

2. Patch / upgrade steps

• Monitor the code-projects project page and the NVD entry for a fixed release. No fixed version currently exists.
• Because no vendor fix is available, the only fully corrective measure is to refactor the vulnerable query to use parameterized statements (prepared statements with bound parameters) for the Name argument, and to apply the same parameterization across all other request handlers. Where the deployed codebase is maintained by an internal team, apply this fix directly and regression-test createuser.php with crafted SQL payloads.

3. Long-term hardening

• Adopt a secure-by-default data-access layer (ORM or prepared statements) with a ban on string-concatenated SQL in code review.
• Enforce least privilege on the database principal used by the application — no DDL/DCL rights, restricted schema visibility.
• Maintain an asset inventory of third-party and demo applications to prevent unsupported code from reaching production.
• Track CVE-2025-11357 in the vulnerability management system with an interim risk acceptance if patch deferral is unavoidable, and re-evaluate on any vendor release, KEV update, or EPSS spike.

References

• NVD — CVE-2025-11357: https://nvd.nist.gov/vuln/detail/CVE-2025-11357
• CNA record (code-projects Simple Banking System createuser.php sql injection) corresponding to the CNA Title field
• CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection): https://cwe.mitre.org/data/definitions/74.html
• CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): https://cwe.mitre.org/data/definitions/89.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor and exploit-in-the-wild evidence: none provided in the source data. Public exploit availability is reported by the CNA/NVD, exploit code was not supplied, no Nuclei template exists, CISA KEV does not list this CVE, and EPSS is 0.00332 (~24.3rd percentile). No attribution is possible from available data.