CVE-2025-61455
Published: 20 October 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-61455 is a SQL injection vulnerability (CWE-89) in Bhabishya-123 E-commerce version 1.0, specifically within the signup.inc.php endpoint. The application directly incorporates unsanitized user inputs into SQL queries without proper sanitization or parameterization, enabling malicious SQL code execution. Published on 2025-10-20, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its high impact on confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction or privileges required. By injecting crafted payloads via the signup endpoint, attackers can bypass authentication mechanisms and gain full access to the application, potentially extracting sensitive data, modifying records, or executing arbitrary administrative actions.
Further technical details, including a proof-of-concept, are available in the referenced GitHub repository at https://github.com/tansique-17/CVE-2025-61455. No specific patches or mitigation steps are outlined in the CVE description.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection in public-facing web application signup endpoint enables unauthenticated remote exploitation for authentication bypass and full access.