CVE-2025-10402 in Beauty Parlour Management System
Summary
by MITRE • 09/14/2025
A flaw has been found in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /admin/readenq.php. Executing manipulation of the argument delid can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/19/2025
The vulnerability identified as CVE-2025-10402 resides within the PHPGurukul Beauty Parlour Management System version 1.1, specifically targeting the administrative component of the application. This system appears to be a web-based management solution for beauty parlors that handles various operational aspects including client management, appointment scheduling, and service tracking. The affected file /admin/readenq.php serves as a critical interface for administrators to review and manage inquiries or bookings within the system. This particular file likely processes user requests related to inquiry management and contains functionality that retrieves and displays information to administrators.
The technical flaw manifests through improper input validation within an unknown function of the readenq.php file, where the delid parameter is directly incorporated into SQL query construction without adequate sanitization or parameterization. This vulnerability represents a classic SQL injection attack vector that allows malicious actors to manipulate database queries through crafted input parameters. The delid argument appears to function as an identifier for specific inquiry records that administrators wish to delete or view, but when this parameter is not properly validated or escaped, it becomes a conduit for database manipulation. The vulnerability is particularly concerning because it enables remote code execution through database manipulation, allowing attackers to potentially extract sensitive information, modify database records, or even escalate privileges within the system.
The operational impact of this vulnerability extends beyond simple data compromise, as it fundamentally undermines the integrity and confidentiality of the beauty parlour management system. Attackers can leverage this SQL injection flaw to access sensitive customer information including personal details, contact information, appointment history, and potentially financial data associated with services. The remote exploitability means that malicious actors do not require physical access to the system or network to carry out attacks, making the vulnerability particularly dangerous for organizations that rely on web-based management solutions. The published exploit availability significantly increases the risk exposure, as it removes the barrier to entry for potential attackers who may not possess advanced technical skills to develop custom exploitation methods.
Security mitigation strategies for this vulnerability should prioritize immediate patching of the affected PHPGurukul Beauty Parlour Management System to the latest version that addresses this SQL injection flaw. Organizations should implement proper input validation and parameterized queries throughout the application codebase to prevent similar vulnerabilities from manifesting in other components. Network segmentation and access controls should be enforced to limit administrative access to the system, while comprehensive logging and monitoring should be implemented to detect unauthorized access attempts. The vulnerability aligns with CWE-89 which specifically addresses SQL injection flaws, and maps to ATT&CK technique T1190 for exploitation of remote services through SQL injection attacks. Regular security assessments and penetration testing should be conducted to identify additional vulnerabilities within the system, while application firewalls and intrusion detection systems can provide additional layers of protection against exploitation attempts.