CVE-2025-51092

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-51092
The LogIn-SignUp project by VishnuSivadasVS is vulnerable to SQL Injection due to unsafe construction of SQL queries in DataBase.php. The functions logIn() and signUp() build queries by directly concatenating user input and unvalidated table names without using prepared statements. While a prepareData() function exists, it is insufficient to prevent SQL injection and does not sanitize the table name.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://abimelsbk.hashnode.dev/sql-injection-vulnerability-at-login-signup-php-project Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:vishnusivadas:login-signup:-:*:*:*:*:*:*:*
History

09 Oct 2025, 18:00

Type Values Removed Values Added
First Time Vishnusivadas
Vishnusivadas login-signup
CPE cpe:2.3:a:vishnusivadas:login-signup:-:*:*:*:*:*:*:*
References () https://abimelsbk.hashnode.dev/sql-injection-vulnerability-at-login-signup-php-project - () https://abimelsbk.hashnode.dev/sql-injection-vulnerability-at-login-signup-php-project - Third Party Advisory

26 Aug 2025, 14:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CWE CWE-89

25 Aug 2025, 20:24

Type Values Removed Values Added
Summary
  • (es) El proyecto LogIn-SignUp de VishnuSivadasVS es vulnerable a la inyección SQL debido a la construcción insegura de consultas SQL en DataBase.php. Las funciones logIn() y signUp() generan consultas concatenando directamente la entrada del usuario y los nombres de tabla no validados, sin usar sentencias preparadas. Si bien existe la función prepareData(), esta no es suficiente para prevenir la inyección SQL y no depura el nombre de la tabla.

22 Aug 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-22 19:15

Updated : 2025-10-09 18:00

NVD link : CVE-2025-51092

Mitre link : CVE-2025-51092

CVE.ORG link : CVE-2025-51092

JSON object : View

Products Affected

vishnusivadas

  • login-signup
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')