CVE Intelligence
Analysis AI-assisted

CVE-2025-69564: code-projects Mobile Shop Management System SQL Injection in ExAddNewUser.php

CVE-2025-69564 is a critical SQL injection issue reported in code-projects Mobile Shop Management System 1.0, affecting the /ExAddNewUser.php endpoint. The NVD record carries a CVSS 3.1 score of 9.8 with network attack vector and no privileges or user interaction required. The record lists no fixed version, is not in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-69564 describes an SQL injection weakness in the /ExAddNewUser.php component of code-projects Mobile Shop Management System 1.0. According to the description, several user-related input fields processed by this script are affected, including name, address, email, username, password, role, branch and activation fields. The record is published in the NVD and the CVE Program, and is marked as analyzed.

Impact

The NVD assigns a CVSS 3.1 base score of 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Under that scoring, an unauthenticated remote attacker could potentially affect confidentiality, integrity and availability. The CWE listed in the record is CWE-94 (Code Injection), which differs from the SQL injection class described in the text; this mismatch is noted in the limitations section.

Affected products and versions

  • The description names code-projects Mobile Shop Management System 1.0.
  • The structured affected-product field names Fabian Mobile Shop Management System, version 1.0.
  • Product naming is inconsistent between the description and the affected-product field, so administrators should confirm which codebase they run.

Exploitation status

The CISA KEV catalog does not list this CVE in the record consulted, so it is not described here as actively exploited. No confirmed exploitation in the wild appears in the sources consulted. Two third-party references are listed, one of which is tagged in the record as exploit-related; the record does not confirm what that material shows, and this analysis does not reproduce or describe any technical details from it.

Remediation and mitigation

  • No fixed version is listed in the record. The absence of a listed fix does not mean none exists; check with the software vendor or maintainer.
  • If the application is not essential, take it offline or restrict access to administrative and registration functions.
  • Limit network exposure of the application to trusted users and networks, and place it behind access controls.
  • Review the code path for user creation and apply parameterized queries and strict server-side input validation, as a general secure development practice.
  • Rotate credentials for any accounts that may have been created or modified through the affected functionality, if compromise is suspected.

Detection guidance

  • Review web server and application logs for unusual or malformed requests to the ExAddNewUser.php endpoint.
  • Look for unexpected new user accounts, role changes or activation changes in the application database.
  • Monitor database error messages surfacing in application responses, which can indicate input handling problems.

Limitations of the available information

  • The record does not list affected version ranges beyond version 1.0, nor any fixed version.
  • The product name differs between the description and the affected-product field.
  • The CWE assigned (CWE-94) does not match the SQL injection described in the text; the weakness class should be confirmed with the CNA or NVD.
  • No proof-of-concept details, vendor advisory or patch were confirmed from the sources consulted.

Frequently asked questions

What is CVE-2025-69564?

It is a reported SQL injection issue in the /ExAddNewUser.php component of code-projects Mobile Shop Management System 1.0, rated critical with a CVSS 3.1 score of 9.8 in the NVD record.

Is a fixed version available?

The record does not list a fixed version. This is unknown rather than confirmed absent, so check with the vendor or maintainer.

Is this vulnerability being actively exploited?

The CVE is not listed in CISA KEV in the record consulted, and no confirmed exploitation in the wild appears in the sources consulted.

What should administrators do now?

Restrict access to the application, limit exposure to trusted networks, review user-creation logs and accounts, and verify with the vendor which product version is in use.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.