CVE-2025-46192

The vulnerability exists in the POST parameter named order_id, transmitted to the user_payment_update.php script. Input data is not properly validated or sanitized before being included in the SQL query. An attacker can inject malicious SQL code that will be executed directly by the database engine. The attack does not require authentication or any user interaction.

An attacker can gain full access to the database — read, modify, or delete its contents, including customer and transaction data. Depending on server configuration, it may also be possible to take control of the operating system.

Apply patches available from the vendor according to references. As an immediate safeguard, it is recommended to restrict access to the vulnerable endpoint at the firewall or web server level and implement parameterized SQL queries (prepared statements) in the application code.

SourceCodester Client Database Management System version 1.0 — user_payment_update.php file, POST parameter order_id.