CVE-2025-10878: Fikir Odalari AdminPando 1.0.1 SQL Injection Authentication Bypass in Login
CVE-2025-10878 describes a SQL injection flaw in the login functionality of Fikir Odalari AdminPando 1.0.1, where the username and password parameters can be abused by unauthenticated attackers to bypass authentication. The record reports a critical CVSS 3.1 score of 10 and CWE-89, with possible full administrative access to the application. No confirmed exploitation appears in CISA KEV in the sources consulted.
Overview
CVE-2025-10878 is a SQL injection weakness (CWE-89) in the login feature of Fikir Odalari AdminPando 1.0.1. According to the record, the flaw affects the username and password parameters and is described as present before 2026-01-26.
Impact
- The record states that unauthenticated attackers can bypass authentication completely.
- Successful exploitation reportedly grants full administrative access to the application.
- With administrative access, the record notes that the public-facing website content could be altered (HTML/DOM manipulation).
- The CVSS 3.1 vector reported is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, with a score of 10 from both the CNA and NVD entries in the record.
Affected Products and Versions
- Product listed as Omran Fikir Odalari Adminpando, with versions recorded as less than or equal to 1.0.1.
- The record does not list specific fixed versions. The absence of fixed versions in the record does not confirm that no fix exists.
Exploitation Status
The CISA KEV entry in the record is not listed. No confirmed exploitation appears in the sources consulted for this record. The record does include two third-party references tagged as exploit-related, which indicates that public exploit material has been referenced; this analysis does not describe or reproduce it.
Remediation and Mitigation
- Identify all deployments of Fikir Odalari AdminPando, including any instances that may be exposed to the internet.
- Check the vendor or project channels for an updated version. The record does not identify a fixed version.
- If no fix is available, consider restricting access to the administrative login through network controls, such as allow-listing trusted networks, and placing the application behind additional authentication layers.
- Review administrative accounts and website content for unauthorized changes, and rotate credentials for administrative users.
- Apply secure coding practices such as parameterized queries, which is a development-side remedy for the affected code.
Detection Guidance
- Review web server and application logs for unusual login requests, repeated failed or anomalous authentication attempts, and unexpected administrative sessions.
- Monitor for unexpected changes to website content, administrative user accounts, or configuration files.
- Use web application firewall or monitoring tools to flag database error messages or anomalous input patterns on the login endpoints, tuned to avoid disclosing exploit details.
Limitations of the Available Information
- The record does not specify the vendor's official fixed version or patch availability.
- The record has a null title and no KEV, EPSS or SSVC data, so exploitation likelihood and prioritization signals are unknown.
- The exact vulnerable code path and the affected deployment conditions are not detailed in the record.
- The date '2026-01-26' appears in the description without further explanation of its meaning.
Frequently asked questions
What is CVE-2025-10878?
It is a SQL injection vulnerability in the login functionality of Fikir Odalari AdminPando 1.0.1 that the record says allows unauthenticated authentication bypass.
Is this vulnerability known to be actively exploited?
The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Is there a fixed version?
The record does not list any fixed version, so the availability of a fix is unknown.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.