CVE-2025-9829 Details

A critical SQL injection vulnerability has been identified in the PHPGurukul Beauty Parlour Management System version 1.1. The issue resides in the signup.php file, where the mobilenumber parameter is manipulated to inject malicious SQL queries. This vulnerability allows remote attackers to access the database without authorization, potentially leading to data modification, deletion, or unauthorized access to sensitive information. The vulnerability arises from inadequate input validation, which fails to properly sanitize user input before it is used in SQL queries. Exploitation of this vulnerability does not require any form of authentication.

It is recommended to implement prepared statements and parameter binding to prevent SQL injection vulnerabilities. Additionally, input validation and filtering should be applied to ensure that user input conforms to expected formats, blocking malicious data. Finally, database user permissions should be minimized, ensuring that the account used to connect to the database has only the necessary privileges.