Executive brief
SourceCodester Modern Loan Management System 1.0 is a software platform used to manage financial loan records and customer data. A security flaw in the system's data handling allows unauthorized individuals to manipulate database queries. This could lead to the theft of sensitive financial information, unauthorized modification of loan records, or a complete takeover of the application's database.
Technical details
A SQL injection vulnerability exists in SourceCodester Modern Loan Management System 1.0 within the 'ajaxData.php' component. The application fails to properly sanitize user-supplied input provided through the 'district_id', 'division_id', 'region_id', and 'ward_id' parameters before using them in SQL queries. A remote, unauthenticated attacker can exploit this by sending specially crafted HTTP requests to the vulnerable endpoint. Successful exploitation allows the attacker to execute arbitrary SQL commands, potentially leading to unauthorized data retrieval, modification, or deletion from the underlying database. No patches are currently documented in the advisory.
Affected products
- SourceCodester Modern Loan Management System 1.0
Timeline
- 2026-07-31: disclosed: Initial publication of CVE-2025-69946
References
- https://github.com/um-dsp/TaintRadar
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-ajaxdata.php-district_id-sqli/20250811-modern-loan-management-system-ajaxdata.php-district_id-sqli.md
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-ajaxdata.php-division_id-sqli/20250811-modern-loan-management-system-ajaxdata.php-division_id-sqli.md
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-ajaxdata.php-region_id-sqli/20250811-modern-loan-management-system-ajaxdata.php-region_id-sqli.md
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-ajaxdata.php-ward_id-sqli/20250811-modern-loan-management-system-ajaxdata.php-ward_id-sqli.md
- https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-delete_group.php-id-sqli/20250811-modern-loan-management-system-delete_group.php-id-sqli.md