CVE-2025-46189

The vulnerability (CWE-89) consists of the lack of proper validation and sanitization of the POST parameter named order_id in the user_order_customer_update.php script. An attacker can pass crafted input containing malicious SQL code, which is directly embedded in the database query. The attack requires no authentication, special privileges, or user interaction, making it particularly dangerous.

An attacker can gain unauthorized access to data stored in the database, modify or delete data (e.g., customer and order data), and in favorable database server configurations, could lead to complete system takeover.

Apply patches available from the vendor according to the references. It is also recommended to implement parameterized SQL queries (prepared statements) in the application code, restrict network access to the system, and verify all input data on the server side.

SourceCodester Client Database Management System version 1.0