Description
SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1.
Published: 2026-07-31
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Modern Loan Management System version 1.0 contains a vulnerability that allows an attacker to inject arbitrary SQL code into the "id" parameter of the "/admin/delete_group.php" endpoint. This flaw enables the execution of unintended SQL statements. The weakness corresponds to the well‑known SQL Injection weakness, categorized as CWE‑89.

Affected Systems

The vulnerability is present in SourceCodester’s Modern Loan Management System 1.0. The flaw is exposed through the administrative delete_group.php page, particularly the "id" query parameter. No other product variants or versions are specified, and no vendor‑specific patch information is available.

Risk and Exploitability

The vulnerability can be triggered by providing a crafted id value to the /admin/delete_group.php endpoint. The EPSS score is <1%, indicating a very low probability of exploitation. This CVE is not listed in CISA's KEV catalog. The CVSS score is 9.8, indicating critical severity.

Generated by OpenCVE AI on August 4, 2026 at 22:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the delete_group.php handler to use parameterized prepared statements for the "id" parameter to prevent injection.
  • Ensure that only authenticated and authorized administrators can access the delete_group endpoint, restricting exposure to the vulnerable parameter.
  • Deploy a web application firewall or input validation layer to detect and block malicious SQL payloads before they reach the application logic.

Generated by OpenCVE AI on August 4, 2026 at 22:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
Title SQL Injection in Modern Loan Management System Admin Delete Group Endpoint

Mon, 03 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
Title SQL Injection in Modern Loan Management System Admin Delete Group Endpoint
Weaknesses CWE-89

Fri, 31 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester modern Loan Management System
Vendors & Products Sourcecodester
Sourcecodester modern Loan Management System

Fri, 31 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Description SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1.
References

Subscriptions

Sourcecodester Modern Loan Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-08-03T17:02:03.179Z

Reserved: 2026-01-09T00:00:00.000Z

Link: CVE-2025-69948

cve-icon Vulnrichment

Updated: 2026-08-03T17:01:39.733Z

cve-icon NVD

Status : Received

Published: 2026-07-31T21:17:30.340

Modified: 2026-08-03T17:16:28.690

Link: CVE-2025-69948

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T23:00:15Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')