CVE-2025-69563: code-projects Mobile Shop Management System SQL Injection in ExLogin.php
The record describes an SQL injection flaw in the Password parameter of /ExLogin.php in code-projects Mobile Shop Management System 1.0, classified as CWE-89 and scored 9.8 (critical) under CVSS 3.1. The record shows no KEV listing, and no confirmed exploitation in the wild appears in the sources consulted. The product name in the affected list differs from the vendor name in the description, so this should be verified.
Overview
CVE-2025-69563 is described as an SQL injection vulnerability in the Password parameter of /ExLogin.php in code-projects Mobile Shop Management System 1.0. The record assigns CWE-89 (SQL Injection) and was published on 2026-01-27 by the CNA cve@mitre.org.
Impact
- The record gives a CVSS 3.1 base score of 9.8 with high confidentiality, integrity and availability impact, and no privileges or user interaction required.
- SQL injection in a login flow can allow manipulation of backend database queries. The exact consequences depend on the application's database configuration, which the record does not describe.
Affected products and versions
- The record lists version 1.0 of 'Fabian Mobile Shop Management System' as affected.
- The description names 'code-projects Mobile Shop Management System', which does not match the affected product name. The correct vendor and product name is unknown from the record.
- No fixed version is listed in the record. This does not confirm that no fix exists.
Exploitation status
- CISA KEV lists this CVE as not listed in the record, so active exploitation is not confirmed by that source.
- Two references are tagged 'Exploit' in the record, which indicates that exploit-related material is associated with this CVE. The content of those references was not verified here.
- No confirmed exploitation in the wild appears in the sources consulted.
Remediation and mitigation
- Check whether the application is deployed and confirm the exact product and version in use.
- Monitor the vendor or the project maintainers for an official fix. No fixed version is listed in the record.
- Restrict network access to administrative and login interfaces where feasible, and place such services behind additional access controls.
- Ask developers to review how the login query handles user input and to use parameterized queries, a defensive coding measure.
Detection guidance
- Review web server and application logs for unusual or malformed input in login requests to /ExLogin.php.
- Monitor for unexpected database errors or anomalous authentication activity around the login endpoint.
- Consider web application firewall rules that flag SQL syntax patterns in login parameters, tuned to reduce false positives.
Limitations of the available information
- The record does not confirm the vendor name, and the product name is inconsistent between fields.
- No fixed version, patch or vendor advisory is listed.
- EPSS and SSVC data are absent from the record.
- The exploit-tagged references were not reviewed in detail, and their reliability is unknown.
Frequently asked questions
What is CVE-2025-69563?
It is a reported SQL injection vulnerability in the Password parameter of /ExLogin.php in code-projects Mobile Shop Management System 1.0, classified as CWE-89.
How severe is this vulnerability?
The record gives a CVSS 3.1 base score of 9.8, which is rated critical. The record does not show a CVSS score from another provider.
Is this vulnerability known to be actively exploited?
The record shows no KEV listing, and no confirmed exploitation in the wild appears in the sources consulted. Two references are tagged as exploit-related, but they were not verified.
Is there a fixed version?
No fixed version is listed in the record. This does not confirm that no fix exists, so check with the vendor or project maintainers.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.