CVE-2025-2655
SourceCodester AC Repair and Services System Users.php delete_users sql injection
- State
- Published
- Severity
- 6.9 Medium
- Published
- Mar 23, 2025
- Updated
- Nov 22, 2025
- Reserved
- Mar 22, 2025
Description
A vulnerability was detected in SourceCodester AC Repair and Services System 1.0. The affected element is the function save_users/delete_users of the file /classes/Users.php. Performing manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. Other parameters might be affected as well.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
AC Repair and Services SystemSourceCodester |
|
References
- VDB-300670 | SourceCodester AC Repair and Services System Users.php delete_users sql injectionvdb-entrytechnical-description
- VDB-300670 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #520017 | www.sourcecodester.com AC Repair and Services System using 1.0 SQL Injection Hibernatethird-party-advisory
- Submit #696635 | SourceCodester AC Repair and Services System 1.0 SQL Injection (Duplicate)third-party-advisory
- https://github.com/Colorado-all/cve/blob/main/AC%20Repair%20and%20Services%20System%20using/SQL-8.mdexploit
- https://www.sourcecodester.com/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.