CVE Intelligence
Analysis AI-assisted

CVE-2025-69562: code-projects Mobile Shop Management System 1.0 SQL Injection via userid in insertmessage.php

CVE-2025-69562 describes an SQL injection flaw in the /insertmessage.php endpoint of code-projects Mobile Shop Management System 1.0, reachable through the userid parameter. The CNA assigned a CVSS 3.1 score of 9.8 (critical) with a network attack vector, low complexity, and no privileges or user interaction required. The record does not list the vulnerability in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-69562 is an SQL injection weakness (CWE-89) in code-projects Mobile Shop Management System 1.0. The vulnerable component is the /insertmessage.php page, and the injectable input is the userid parameter. The record was published on 2026-01-27 and assigned by the CNA cve@mitre.org.

Impact

  • The CNA scored the issue at 9.8 under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • Under that vector, the flaw is reachable over the network without authentication or user interaction, and the scored impact covers high confidentiality, integrity and availability.
  • The practical consequences in a specific deployment depend on the database permissions and how the application is configured, which the record does not describe.

Affected products and versions

  • The description names code-projects Mobile Shop Management System 1.0.
  • The structured affected-product field names Fabian Mobile Shop Management System, version 1.0. The two product names differ, and the record does not explain the discrepancy.
  • No fixed version is listed in the record. This does not mean no fix exists; it means the sources consulted do not report one.

Exploitation status

  • The record does not mark the vulnerability as listed in CISA KEV.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • Two third-party references are tagged as exploit-related in the record. This indicates that public material of that type is referenced, but the record does not establish how widely it is used.

Remediation and mitigation

  • Check whether the product is deployed and whether the vendor or project has published a corrected release. The record does not identify one.
  • Until a fix is confirmed, restrict network access to the administrative and public pages of the application, and place it behind controls that limit exposure.
  • Use parameterized queries or prepared statements for all database access that involves request parameters, which addresses the root cause class.
  • Review database account privileges so that the application account has only the rights it needs.

Detection guidance

  • Review web server and application logs for requests to /insertmessage.php with unusual or malformed values in the userid parameter, such as unexpected characters or errors referencing the database.
  • Monitor for database error messages returned to clients and for unexpected changes in message or user tables.
  • Where a web application firewall is available, enable rules for SQL injection patterns and review alerts for this endpoint.

Limitations of the available information

  • The record does not include a vendor advisory, a fixed version, or a patch.
  • The product name differs between the description and the affected-product field.
  • Environment-specific details, such as the database engine and whether the endpoint is internet-facing, are not provided.
  • The analysis is limited to the record and its cited pages.

Frequently asked questions

What is the vulnerability in CVE-2025-69562?

It is an SQL injection flaw (CWE-89) in the /insertmessage.php page of code-projects Mobile Shop Management System 1.0, triggered through the userid parameter.

How severe is it according to the record?

The CNA assigned a CVSS 3.1 base score of 9.8, which is rated critical, with a network vector and no privileges or user interaction required.

Is this vulnerability known to be actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. Two third-party references are tagged as exploit-related, which does not by itself confirm exploitation.

Is there a fixed version?

The record does not list a fixed version. The sources consulted do not report a patch, so administrators should check with the vendor or project.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.