Vulnerability · Published Oct 13, 2025 · Assigned by VulDB
CVE-2025-11663Campcodes Online Beauty Parlor Management System manage-services.php sql injection
Medium 4.7
In plain English
A medium-severity SQL injection in Online Beauty Parlor Management System from Campcodes. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Official description
A weakness has been identified in Campcodes Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/manage-services.php. This manipulation of the argument sername causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Campcodes | Online Beauty Parlor Management System | 1.0 |
Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-328082 | Campcodes Online Beauty Parlor Management System manage-services.php sql injection vdb-entry, technical-description
- VDB-328082 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #672848 | Campcodes Complete Online Beauty Parlor Management System V1.0 SQL Injection third-party-advisory
- https://github.com/HYLCXH/CVE/issues/12 exploit, issue-tracking
- https://www.campcodes.com/ product