CVE-2025-69948

View on CVE.org
Published Jul 31, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Description
SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1.

Analysis

AI-generated

Technical impact

The Modern Loan Management System version 1.0 contains a vulnerability that allows an attacker to inject arbitrary SQL code into the "id" parameter of the "/admin/delete_group.php" endpoint. This flaw enables the execution of unintended SQL statements. The weakness corresponds to the well‑known SQL Injection weakness, categorized as CWE‑89.

Affected Systems

The vulnerability is present in SourceCodester’s Modern Loan Management System 1.0. The flaw is exposed through the administrative delete_group.php page, particularly the "id" query parameter. No other product variants or versions are specified, and no vendor‑specific patch information is available.

Risk and Exploitability

The vulnerability can be triggered by providing a crafted id value to the /admin/delete_group.php endpoint. The EPSS score is <1%, indicating a very low probability of exploitation. This CVE is not listed in CISA's KEV catalog. The CVSS score is 9.8, indicating critical severity.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the delete_group.php handler to use parameterized prepared statements for the "id" parameter to prevent injection.
  • Ensure that only authenticated and authorized administrators can access the delete_group endpoint, restricting exposure to the vulnerable parameter.
  • Deploy a web application firewall or input validation layer to detect and block malicious SQL payloads before they reach the application logic.

Generated by OpenCVE AI on August 4, 2026 at 22:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title SQL Injection in Modern Loan Management System Admin Delete Group Endpoint
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title SQL Injection in Modern Loan Management System Admin Delete Group Endpoint
Weaknesses CWE-89
Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester modern Loan Management System
Vendors & Products Sourcecodester
Sourcecodester modern Loan Management System
Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 3, 2026, 5:02 PM
Reserved
Jan 9, 2026, 12:00 AM

View source JSON

Updated
Aug 3, 2026, 5:01 PM

JSON

Status
Deferred
Published
Jul 31, 2026, 9:17 PM
Modified
Oct 13, 2026, 10:10 AM

View source JSON

No data.

Updated
Aug 4, 2026, 11:00 PM

JSON