CVE-2025-15186CWE-74CWE-89sql-injection

CVE-2025-15186

High · published December 29, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
31.6
In the wild
Unconfirmed
What it is

⚠️ A sneaky argument manipulation in the Refugee Food Management System could lead to SQL injection! Just a simple tweak to the 'a' parameter can open the floodgates for attackers! 🌊 Think of it like a restaurant's order system: if the server misinterprets a simple request, they might end up serving the wrong dish — or worse, giving away the secret recipe! That's how this vulnerability can let attackers manipulate your database. An attacker could exploit this SQL injection vulnerability to access or manipulate sensitive data in the database, potentially resulting in unauthorized information disclosure or even data loss. While it's classified as medium severity, the implications could still be quite serious for affected users.

Put simply

Think of it like a restaurant's order system: if the server misinterprets a simple request, they might end up serving the wrong dish — or worse, giving away the secret recipe! That's how this vulnerability can let attackers manipulate your database. This vulnerability in the Refugee Food Management System occurs when the application fails to properly validate user input in the 'a' parameter of the addusers.php file, allowing for SQL injection attacks that can be executed remotely.

What to do

An attacker could exploit this SQL injection vulnerability to access or manipulate sensitive data in the database, potentially resulting in unauthorized information disclosure or even data loss. While it's classified as medium severity, the implications could still be quite serious for affected users. To protect your system, patch the Refugee Food Management System to the latest version as soon as it becomes available. Implement proper input validation and prepared statements for database queries to mitigate SQL injection risks. Regular audits of your code can also help you spot similar vulnerabilities before they become an issue. You've got this! By taking these steps, you'll be locking down your application and keeping those sneaky attacks at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00387 · 31.6th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-12-29T17:15Z
Affected products (1)
ProductVersionsFixed in
fabian/refugee_food_management_systemall versions—
References (6)
EPSS history
Timeline
  • 29 DEC 11:32Z
    code-projects Refugee Food Management System addusers.php sql injection
    cvelistv5