CVE-2025-11358

Executive Summary

CVE-2025-11358 is a SQL injection vulnerability in code-projects Simple Banking System 1.0, specifically within the /removeuser.php component, where manipulation of the ID argument permits injection of arbitrary SQL statements. The flaw is remotely exploitable by an authenticated user (privileges required: low) with a published public proof-of-concept, though no confirmed in-the-wild exploitation is currently documented (EPSS 0.00332, 24.3rd percentile). Organizations running this PHP-based banking application — primarily educational, demo, or low-maturity deployments — should treat the system as unpatched and restrict network exposure immediately.

Technical Analysis

The CVE record maps the weakness to CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, i.e. injection), with the concrete vulnerability class being SQL injection (CWE-89 lineage). The affected artifact is code-projects Simple Banking System version 1.0. The NVD description states that an "unknown function" of the file /removeuser.php is impacted, and that "executing manipulation of the argument ID can lead to sql injection."

From the description, the following is technically derivable and nothing further should be assumed:

• Attack surface: The /removeuser.php endpoint, which, based on its filename, is expected to handle user/account deletion operations within the banking application. Public availability of the endpoint is implied by the description ("The attack may be launched remotely").
• Injection point: The ID argument — a request parameter consumed by the application and inserted into a database query without adequate sanitization or parameterization. The description does not specify whether ID is transmitted via GET query string or POST body; both are plausible for a PHP endpoint of this naming convention, and no source data is provided to disambiguate.
• Root cause: Absence of parameterized queries / prepared statements or equivalent input neutralization, allowing attacker-controlled data to be interpreted as SQL syntax by the backing database.
• Authentication context: CVSS vector PR:L (Privileges Required: Low) indicates the attacker must hold some valid low-privileged session or account on the application. This is consistent with a user-management endpoint that is gated behind a login (e.g., an administrative or teller interface), though the exact authorization model is not stated in the provided data.
• Impact triad: C:L/I:L/A:L — Low confidentiality, integrity, and availability impacts individually. This reflects that SQL injection at this endpoint can read, modify, or affect availability of data reachable by the application's database account, but the scope remains unchanged (S:U), meaning exploitation does not pivot the security authority beyond the vulnerable component.

No CVE data provided names specific database backends, table names, functions, or query strings. Accordingly, any claim about the exact SQL statement structure would be speculative and is deliberately omitted.

Exploitation Scenarios

The following attack chain is derived strictly from the NVD description and standardized SQL injection mechanics. No public exploit code is available in the tracked data (Exploit Code: NO), although a PoC is flagged as public (POC_STATUS: Public). No Nuclei template exists.

1) Reconnaissance / target identification An attacker enumerates internet-facing or internally reachable instances of code-projects Simple Banking System 1.0. Because the product is a known educational/demo project, discoverable via application fingerprinting (page titles, static assets, and the characteristic file names such as removeuser.php), reconnaissance is low-cost. Shodan-class searches for the application title or the removeuser.php path narrow the candidate set.

2) Triggering the flaw (vulnerability-class level) The attacker first authenticates to satisfy the PR:L requirement, obtaining a low-privileged session. The attacker then issues a request to /removeuser.php that supplies a crafted value in the ID argument. Because the application does not neutralize special elements before passing ID into a downstream SQL interpreter (CWE-74), the crafted value alters the structure of the executed query rather than being treated as inert data.

3) Payload / execution method (vulnerability-class level) At the class level, exploitation follows standard SQL injection technique: tautology-based logic manipulation, UNION-style result-set injection, or stacked/boolean/error-based inference — selected according to the (undisclosed) database engine and query behavior. The description provides no verified proof-of-concept string, endpoint method, or parameter encoding, so no specific payload is asserted here. The public availability of a PoC means a working attack string is presumed accessible to adversaries, lowering the skill barrier to exploitation.

4) Post-exploitation impact With the low confidentiality/integrity/availability ratings, realistic outcomes include: disclosure of data returned or inferable through the injected query (customer records, account data, credentials, or application metadata), modification of stored data reachable by the injection, and limited disruption of the affected functions. Given Scope is Unchanged, the attacker does not gain control beyond the vulnerable component's authority; however, because this is a banking-domain application, any leakage of user or financial records carries elevated real-world consequences even at "Low" per-metric ratings.

Note: No public PoC code was provided in the source data; the above chain is inferred from the SQL injection vulnerability class and the stated CVSS/parameter facts.

Impact Assessment

• Confidentiality (Low): Injection may expose database content reachable by the application's database account. In a banking context, even limited record exposure is material.
• Integrity (Low): Attacker-influenced queries can alter stored data, including records associated with the user-management function the endpoint appears to serve.
• Availability (Low): Malformed or resource-intensive queries can degrade or interrupt the affected endpoint.
• Privileges Required (Low): An authenticated session is needed, raising the barrier slightly versus an unauthenticated flaw.
• Scope (Unchanged): Impact is confined to the vulnerable component; no direct privilege escalation into other security authorities is implied.

Blast radius: Deployments of code-projects Simple Banking System 1.0. As an educational/demo codebase, real-world exposure is likely concentrated in test, training, and low-maturity production environments — but any live deployment holding real user data inherits the full confidentiality/integrity implications. Business impact centers on data breach risk, regulatory exposure for financial data, and reputational damage. There is no evidence of exploitation in the wild and no CISA KEV listing; current urgency is driven by the public PoC rather than observed campaigns.

Detection Guidance

Sigma Rule

title: SQL Injection Attempt Against Simple Banking System removeuser.php
id: 8f2c1a44-2b7e-4d9a-9c31-cve202511358
status: experimental
description: Detects SQL injection patterns in requests targeting removeuser.php ID parameter
logsource:
  category: webserver
  product: apache
detection:
  selection_uri:
    cs-uri-stem|endswith: '/removeuser.php'
  selection_sqli:
    cs-uri-query|contains:
      - "' OR "
      - "' OR '1'='1"
      - "UNION SELECT"
      - "'--"
      - "concat("
      - "information_schema"
      - "sleep("
      - "benchmark("
  condition: selection_uri and selection_sqli
fields:
  - c-ip
  - cs-uri-query
  - cs-method
falsepositives:
  - Security scanners and authorized penetration testing
level: high
tags:
  - attack.t1190
  - cve.2025.11358

YARA Rule

rule CVE_2025_11358_SQLi_removeuser
{
    meta:
        description = "Detects SQL injection attempts targeting removeuser.php ID parameter in Simple Banking System 1.0"
        cve = "CVE-2025-11358"
        author = "valtersit.com"
        date = "2025-01-01"
        severity = "high"

    strings:
        $p1 = "/removeuser.php"
        $s1 = "UNION SELECT" nocase
        $s2 = "' OR '" nocase
        $s3 = "information_schema" nocase
        $s4 = "sleep(" nocase
        $s5 = "benchmark(" nocase
        $s6 = "removeuser.php?id=" nocase

    condition:
        $p1 and 1 of ($s1, $s2, $s3, $s4, $s5, $s6)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2025-11358 SQL Injection Attempt Against Simple Banking System removeuser.php"; flow:established,to_server; http.uri; content:"/removeuser.php"; http.uri; content:"id="; nocase; pcre:"/(\%27|')(\s)*(or|union|select|sleep|benchmark)/i"; reference:cve,2025-11358; classtype:web-application-attack; sid:202511358; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [network where url.path == "/removeuser.php" and url.query : ("*UNION SELECT*" or "*' OR *" or "*information_schema*" or "*sleep(*" or "*benchmark(*")]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="/removeuser.php"
| eval sqli=if(match(uri_query, "(?i)(union\s+select|'\s*or\s*|information_schema|sleep\(|benchmark\(|--|\%27)"), 1, 0)
| where sqli=1
| stats count values(uri_query) as payloads by src_ip, uri_path
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2025-11358,">
  <rule id="202511358" level="12">
    <if_sid>31100</if_sid>
    <id>^GET|^POST</id>
    <url>/removeuser.php</url>
    <match>union select|' or |information_schema|sleep(|benchmark(|--</match>
    <description>CVE-2025-11358: SQL injection attempt against Simple Banking System removeuser.php ID parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sql_injection,gdpr_IV_35.7.d,pci_dss_6.5.1,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, affected-version advisory, or workaround is registered in the tracked data. Treat all installations of Simple Banking System 1.0 as vulnerable.

1) Immediate mitigations

• Remove or disable /removeuser.php (and related user-management endpoints) if the functionality is not strictly required in the deployed environment.
• Restrict network access to the application: place it behind authentication and IP allow-listing; do not expose it directly to the internet.
• Deploy a WAF or reverse-proxy rule set that blocks SQL metacharacters and known injection patterns on the ID parameter (see detection rules above).
• Enforce least privilege on the application's database account so a successful injection cannot reach unrelated schemas or perform administrative operations.
• Given this is a demo/educational codebase, isolate any running instance from production data and networks.

2) Patch / upgrade steps

• No patched version or vendor advisory exists in the tracked sources. Monitor the code-projects project repository and NVD for a future fix.
• Until a vendor patch is available, prioritize deployment removal, isolation, or source-level remediation: refactor the vulnerable query to use parameterized statements / prepared statements and strict server-side validation of the ID parameter against an explicit allow-list of expected values.

3) Long-term hardening

• Mandate prepared statements / parameterized queries across the codebase and ban string-concatenated SQL in code review.
• Adopt a secure SDLC with static analysis (SAST) and DAST in CI to catch injection flaws pre-deployment.
• Apply input validation and output encoding at trust boundaries; validate that ID is a well-formed integer where the domain only expects numeric identifiers.
• Maintain an SBOM and vulnerability-management feed to track unpatched components such as this one.

References

• NVD — CVE-2025-11358: https://nvd.nist.gov/vuln/detail/CVE-2025-11358
• CWE-74 — Improper Neutralization of Special Elements: https://cwe.mitre.org/data/definitions/74.html
• CWE-89 — SQL Injection: https://cwe.mitre.org/data/definitions/89.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• code-projects Simple Banking System project source: https://code-projects.org/

No threat actor campaign, CISA KEV entry, or confirmed in-the-wild exploitation is associated with CVE-2025-11358 in the provided data. A public proof-of-concept is available, which elevates the likelihood of opportunistic exploitation but does not constitute evidence of active campaigns.