CVE-2025-65354 — SQL Injection Vulnerability

Summary

An SQL Injection vulnerability exists in the PuneethReddyHC event-management application version 1.0 due to improper input handling.

Vulnerability Type

SQL Injection

Affected Component

Endpoint: /Grocery/search_products_itname.php Parameter: sitem_name (POST)

Attack Type

Remote

Impact

A remote, unauthenticated attacker can manipulate SQL queries by injecting crafted payloads into the sitem_name POST parameter. Successful exploitation may allow alteration of query logic and disclosure of database contents, potentially leading to sensitive data exposure and backend compromise.

Affected Versions

PuneetethReddyHC event-management v1.0

Proof of Concept

Boolean-based SQL injection payloads were used to demonstrate the issue. Example payloads:

-1' OR 5*5=25 --

-1' OR 5*5=26 --

-1' OR 231=6 AND 000648=000648 --

Mitigation

Use parameterized queries or prepared statements, validate and whitelist user input, enforce strict input length and character restrictions, and run the database with least-privilege permissions.

Credits

Discovered by Amaan Siddiqui GitHub: https://github.com/amaansiddd787

CVE

CVE-2025-65354