# CVE-2026-104625: CodeAstro Simple Loan Management System SQL injection in group parameter

Source: https://junglewise.ai/threats/cve-2026-104625-a-security-flaw-has-been-discovered-in-codeastro-simple-loan  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-104625 · Severity: medium · CVSS 6.3 · Published 2026-10-02

CodeAstro Simple Loan Management System is a web-based loan and group management application. A SQL injection vulnerability in the admin panel allows attackers to manipulate the g_name parameter and execute arbitrary database queries, potentially exposing sensitive financial and borrower data, modifying loan records, or disrupting service availability.

Vendors: [CodeAstro](https://junglewise.ai/threats/vendors/codeastro).

## Quick answers

**Is CVE-2026-104625 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104625 being exploited in the wild.

**How severe is CVE-2026-104625?** Medium severity, with a CVSS score of 6.3, published 2 October 2026.

**Which products and versions are affected?** CodeAstro Simple Loan Management System 1.0.

**Is there a fix for CVE-2026-104625?** No fixed version is recorded yet. Use prepared statements and parameterized queries to separate SQL code from user input. Implement strict input validation and filtering to ensure the g_name parameter conforms to an expected format. Run the database service with minimal required permissions, avoiding privileged accounts like root or admin.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-02","note":"Vulnerability published on NVD"},{"kind":"other","at":"2026-09-07","note":"SQL injection reported on GitHub issue tracker"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-104625 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-104625?** Check whether you run CodeAstro Simple Loan Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Use prepared statements and parameterized queries to separate SQL code from user input. Implement strict input validation and filtering to ensure the g_name parameter conforms to an expected format. Run the database service with minimal required permissions, avoiding privileged accounts like root or admin.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-02","note":"Vulnerability published on NVD"},{"kind":"other","at":"2026-09-07","note":"SQL injection reported on GitHub issue tracker"}]

## Technical details

A SQL injection vulnerability exists in the /admin/index.php file (page=add_group parameter) where the g_name parameter is directly concatenated into a SQL query without sanitization or parameterized statements. An unauthenticated attacker can send a POST request with crafted SQL payloads to extract data, modify database contents, or achieve database control. Both error-based and time-based blind SQL injection techniques are viable.

## Affected products

- CodeAstro Simple Loan Management System 1.0

## References

- [https://codeastro.com/](https://codeastro.com/)
- [https://github.com/yihaofuweng/cve/issues/77](https://github.com/yihaofuweng/cve/issues/77)