CVE-2025-14647
BaseFortify
Publication date: 2025-12-14
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| carmelo | computer_book_store | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a SQL injection weakness in the /admin_delete.php file of code-projects Computer Book Store 1.0. It occurs due to manipulation of the 'bookisbn' argument, allowing an attacker to inject malicious SQL code. The attack can be initiated remotely and the exploit is publicly available.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to execute arbitrary SQL commands on the database, potentially leading to unauthorized data access, data modification, or deletion. This can compromise the integrity, confidentiality, and availability of the affected system's data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This SQL injection vulnerability allows unauthorized access, modification, deletion, and exposure of sensitive information, which can lead to violations of data protection regulations such as GDPR and HIPAA. Exploitation of this flaw compromises confidentiality, integrity, and availability of data, potentially resulting in non-compliance with these standards that require protection of personal and sensitive data. Immediate remediation is necessary to maintain compliance and protect data security. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the 'bookisbn' parameter in the 'admin_delete.php' file for SQL injection flaws. One practical approach is to use automated tools like sqlmap to test the endpoint. For example, a command such as `sqlmap -u "http://target/admin_delete.php?bookisbn=1" --batch` can be used to check for SQL injection vulnerabilities. Additionally, attackers may use Google hacking techniques like searching for 'inurl:admin_delete.php' to identify vulnerable targets. Monitoring for unusual database queries or unexpected behavior in the application logs can also help detect exploitation attempts. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Replacing the affected software with an alternative product, as there are currently no known mitigations or countermeasures for this vulnerability. 2) Implementing prepared statements with parameter binding to separate SQL code from user input. 3) Applying strict input validation and filtering to ensure inputs conform to expected formats. 4) Limiting database user permissions to the minimum necessary, avoiding use of high-privilege accounts for routine operations. These actions help prevent SQL injection attacks and protect system security and data integrity. [2, 3]