CVE-2025-14990

Executive Summary

CVE-2025-14990 is a critical SQL injection vulnerability in Campcodes Complete Online Beauty Parlor Management System 1.0. The flaw resides in the /admin/view-appointment.php file, where the viewid parameter is directly concatenated into SQL queries without sanitization or parameterization. An unauthenticated attacker can exploit this remotely to extract, modify, or delete database contents, potentially leading to full administrative compromise. The exploit has been publicly released, increasing the risk of widespread attacks. No official patch exists, and the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP web application. However, organizations using this software should treat it as a supply chain risk due to the lack of vendor support and patch availability.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no victim action required.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – full database read access.
• Integrity Impact: High (I:H) – ability to modify or delete data.
• Availability Impact: High (A:H) – potential for denial of service via destructive queries.

Threat Level: Critical. The combination of remote exploitability, no authentication, and public exploit code makes this a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the viewid parameter of /admin/view-appointment.php. The application likely constructs a SQL query similar to:

SELECT * FROM appointments WHERE id = $_GET['viewid'];

Without input validation or prepared statements, an attacker can inject arbitrary SQL commands. For example, a payload like 1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 can be used to enumerate columns and extract data from other tables (e.g., admin_users).

The attack is trivial to execute with tools like sqlmap or manual HTTP requests. The lack of authentication on the admin panel (or weak authentication) further exacerbates the risk.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

<?php
$id = $_GET['viewid'];
$query = "SELECT * FROM appointments WHERE id = $id";
$result = mysqli_query($conn, $query);
?>

Patched Code (PHP):

<?php
$id = intval($_GET['viewid']); // Cast to integer
$query = "SELECT * FROM appointments WHERE id = ?";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "i", $id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
?>

The patched version uses parameterized queries and input validation (casting to integer) to prevent SQL injection. Since no official patch exists, manual remediation is required.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target URL: http://target.com/admin/view-appointment.php?viewid=1
• Tool: sqlmap or manual HTTP client (e.g., curl)

Manual Exploit:

curl "http://target.com/admin/view-appointment.php?viewid=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100-- -"

Automated Exploit with sqlmap:

sqlmap -u "http://target.com/admin/view-appointment.php?viewid=1" --batch --dbs

Lab Setup:

1. Download the vulnerable application from Campcodes (version 1.0).
2. Set up a local web server (e.g., XAMPP) with PHP and MySQL.
3. Import the provided database schema.
4. Access the admin panel and test the exploit.

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /admin/view-appointment.php for abnormal viewid parameters (e.g., containing SQL keywords like UNION, SELECT, --).
• Use WAF rules to block SQL injection patterns.
• Enable database query logging to identify suspicious queries.

Mitigation:

• Immediately apply input validation and parameterized queries (see patched code).
• Restrict access to the admin panel via IP whitelisting or VPN.
• Deploy a Web Application Firewall (WAF) with SQL injection signatures.
• Consider migrating to a supported platform if the vendor remains unresponsive.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /admin/view-appointment.php with viewid containing SQL keywords.
  • Outbound database connections from the web server to unknown IPs (data exfiltration).
• File System:
  • Unexpected files in the web root (e.g., webshells uploaded via SQL injection).
  • Modified .htaccess files.
• Database:
  • New or modified admin users.
  • Unusual queries in MySQL logs (e.g., UNION SELECT, LOAD_FILE).
• Logs:
  • Web server logs showing viewid parameters with encoded SQL payloads.
  • Database error messages in application logs (e.g., You have an error in your SQL syntax).

Detection Engineering

YARA Rule

rule CVE_2025_14990_SQLi_ViewID {
    meta:
        description = "Detects SQL injection attempts targeting viewid parameter in Campcodes Beauty Parlor Management System"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-14990"
    strings:
        $sqli1 = "viewid=" nocase
        $sqli2 = "UNION" nocase
        $sqli3 = "SELECT" nocase
        $sqli4 = "OR 1=1" nocase
        $sqli5 = "--" nocase
    condition:
        $sqli1 and any of ($sqli2, $sqli3, $sqli4, $sqli5)
}

Sigma Rule

title: SQL Injection Attempt on Campcodes Beauty Parlor viewid Parameter
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts targeting the viewid parameter in /admin/view-appointment.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "viewid="
        cs-uri-query|contains|all:
            - "UNION"
            - "SELECT"
    condition: selection
falsepositives:
    - Legitimate use of UNION in rare cases (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-14990 SQL Injection Attempt on viewid"; flow:to_server,established; content:"/admin/view-appointment.php"; http_uri; content:"viewid="; http_uri; pcre:"/viewid=.*(UNION|SELECT|OR\s+1=1|--)/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Apply the patched code (parameterized queries) to /admin/view-appointment.php. If unable to modify code, block access to the file via .htaccess:

   <Files "view-appointment.php">
       Order Allow,Deny
       Deny from all
   </Files>
   

2. Short-term: Deploy a WAF with SQL injection rules. Restrict admin panel access to trusted IPs.
3. Long-term: Replace the vulnerable application with a supported alternative. If the vendor releases a patch, test and apply it immediately.
4. Monitoring: Enable detailed logging for web and database servers. Set up alerts for SQL injection patterns.
5. User Education: Train administrators to avoid using unsupported software and to follow secure coding practices.

Valters IT
Securing Digital Frontiers