{"vulnerability": "CVE-2025-1456", "sightings": [{"uuid": "7419bd3d-4c5d-4cc1-be66-1fa3ef1d1c99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1456", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lmmiyofvy62v", "content": "", "creation_timestamp": "2025-04-12T12:12:58.785644Z"}, {"uuid": "a0c5adf4-9a18-4451-969c-85b83a3c2b72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-14569", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3m7sti2o5k52x", "content": "", "creation_timestamp": "2025-12-12T19:35:11.114618Z"}, {"uuid": "16d1f0a9-78a0-437b-8168-6c02559bc146", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-14568", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3m7su24oibx2u", "content": "", "creation_timestamp": "2025-12-12T19:45:17.112655Z"}, {"uuid": "f262235f-beeb-428a-b0b0-80c34962a194", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-14567", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3m7sutp2vn42m", "content": "", "creation_timestamp": "2025-12-12T19:59:35.275524Z"}, {"uuid": "593a6417-c04b-453b-9803-21f2e044d835", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-14565", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3m7svflvolj22", "content": "", "creation_timestamp": "2025-12-12T20:09:36.005279Z"}, {"uuid": "62823507-3b1b-4248-9cc0-8fc15d84c5f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-14560", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3melmweqeno2j", "content": "", "creation_timestamp": "2026-02-11T13:55:15.737009Z"}, {"uuid": "61117b31-2563-4247-aeba-8e656b6a5f5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1456", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/11551", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-1456\n\ud83d\udd25 CVSS Score: 6.4 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)\n\ud83d\udd39 Description: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `widgetGrid`, `widgetCountDown`, and `widgetInstagramFeed` methods in all versions up to, and including, 1.7.1012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\n\ud83d\udccf Published: 2025-04-12T08:22:40.950Z\n\ud83d\udccf Modified: 2025-04-12T08:22:40.950Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/68c6e428-b9cf-442f-a896-a8ceb4b9be0e?source=cve\n2. https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/assets/js/frontend.min.js\n3. https://plugins.trac.wordpress.org/changeset/3262790/royal-elementor-addons/tags/1.7.1013/assets/js/frontend.js?old=3255849&old_path=royal-elementor-addons%2Ftags%2F1.7.1012%2Fassets%2Fjs%2Ffrontend.js", "creation_timestamp": "2025-04-12T08:51:05.000000Z"}, {"uuid": "bdb6c4d0-ca44-4e67-b290-b100fbfdccda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1456", "type": "seen", "source": "https://t.me/cvedetector/22799", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-1456 - Elementor Royal Stored Cross-Site Scripting Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-1456 \nPublished : April 12, 2025, 9:15 a.m. | 1\u00a0hour ago \nDescription : The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `widgetGrid`, `widgetCountDown`, and `widgetInstagramFeed` methods in all versions up to, and including, 1.7.1012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. \nSeverity: 6.4 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"12 Apr 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-04-12T12:30:52.000000Z"}, {"uuid": "1c743c7c-c4d3-4fa2-9990-7b67e333a323", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-14562", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mrumu73k2a2n", "content": "\ud83d\udd17 CVE : CVE-2025-14562, CVE-2026-12436, CVE-2026-13113, CVE-2026-14341, CVE-2026-14351, CVE-2026-15077, CVE-2026-15831, CVE-2026-15975, CVE-2026-16553, CVE-2026-3093, CVE-2026-4672, CVE-2026-6267, CVE-2026-6336", "creation_timestamp": "2026-07-30T14:15:30.728314Z"}, {"uuid": "2eb1d356-3397-4205-9d41-411f07b4eb3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-14562", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities_20260730", "content": "", "creation_timestamp": "2026-07-30T04:45:51.909447Z"}, {"uuid": "cfa2ab9d-dbeb-4a44-ad06-d02b3dd11cbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-14567", "type": "seen", "source": "https://gist.github.com/qianqiusujiu/aac85c8baf201da8e39e56db374ad249", "content": "# Vulnerabilities in stock-management-system (haxxorsid/stock-management-system)\n\n**Product:** stock-management-system  \n**Vendor:** haxxorsid  \n**Repository:** https://github.com/haxxorsid/stock-management-system  \n**Affected version:** latest commit at time of audit (HEAD, shallow clone)  \n**Vulnerability types:** SQL Injection (CWE-89), Broken Access Control (CWE-862)  \n**Severity:** 10 High, 0 Medium  \n**Disclosure date:** 2026-08-11  \n\n## Summary\n\nstock-management-system is a small PHP web application. A code review identified 10 security issues (10 high, 0 medium) caused by untrusted user input reaching dangerous sinks without proper sanitization / parameterized queries.\n\n## Affected endpoints / root causes\n\n### V1 \u2014 Unauthenticated SQL Injection via unvalidated `id` in Customer model (UPDATE/DELETE)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Customer.php:60`  \n- **Entry point:** PATCH /api/customers (body id) and DELETE /api/customers (body id)  \n- **Prerequisite:** None (ApiRoutes::invoke performs no Auth::userLogged() check; endpoint is unauthenticated)  \n- **Trigger chain:** $_REQUEST['id'] -> CustomerController::update/delete -> Customer::update/delete -> mysqli query \"UPDATE customers ... WHERE id=\" . $data['id'] / \"DELETE ... WHERE id='$id'\"  \n- **Proof of Concept:**  \n```\nPATCH /api/customers HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1 OR 1=1-- -&name=Test&address=addr&email=a@b.com&phone=1234567890\n\nDELETE /api/customers HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for all id values (e.g. $stmt=$conn->prepare(\"DELETE FROM customers WHERE id=?\")); cast id to int; or enforce API authentication in ApiRoutes::invoke.  \n- **Dedup note:** CLEAN  \n\n### V2 \u2014 Unauthenticated SQL Injection via unvalidated `id` in Employee model (UPDATE/DELETE)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Employee.php:59`  \n- **Entry point:** PATCH /api/employees (body id) and DELETE /api/employees (body id)  \n- **Prerequisite:** None (ApiRoutes performs no authentication; note CVE-2025-14567 already covers the missing-auth of /api/employees, but the Employee-model SQLi sink itself is not covered by CVE-2025-14568 which names model/User.php)  \n- **Trigger chain:** $_REQUEST['id'] -> EmployeeController::update/delete -> Employee::update/delete -> mysqli query \"... WHERE id=\" . $data['id'] / \"DELETE ... WHERE id='$id'\"  \n- **Proof of Concept:**  \n```\nPATCH /api/employees HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1 OR 1=1-- -&name=Test&address=addr&phone=1234567890&gender=M&doj=2020-01-01\n\nDELETE /api/employees HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for id; cast id to int; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V3 \u2014 Unauthenticated SQL Injection via `id` and `address` in Merchant model (UPDATE/DELETE/INSERT)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Merchant.php:63`  \n- **Entry point:** PATCH /api/merchants (id), DELETE /api/merchants (id), POST /api/merchants (address)  \n- **Prerequisite:** None (unauthenticated API)  \n- **Trigger chain:** $_REQUEST['id'] -> Merchant::update/delete \"WHERE id=\" . $data['id'] / \"WHERE id='$id'\"; $_REQUEST['address'] only length-validated by ValidateParams::address (htmlspecialchars does not escape single quotes for SQL) -> Merchant::insert/update string-concatenated into SQL  \n- **Proof of Concept:**  \n```\nDELETE /api/merchants HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n\nPOST /api/merchants HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nname=Shop&address=x',(SELECT 1 FROM (SELECT SLEEP(5))x),'&email=a@b.com&phone=1234567890\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements; validate/cast id; escape or bind address; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V4 \u2014 Unauthenticated SQL Injection via unvalidated `name` (and `id`) in Product model  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Product.php:27`  \n- **Entry point:** POST /api/products (name), PATCH /api/products (name,id), DELETE /api/products (id)  \n- **Prerequisite:** None (unauthenticated API)  \n- **Trigger chain:** ValidateParams::productName only checks strlen<=35 (does NOT block single quotes) -> Product::insert \"INSERT INTO products (name) VALUES ('\" . $data['name'] . \"')\" / Product::update name / Product::delete id; all concatenated into mysqli query  \n- **Proof of Concept:**  \n```\nPOST /api/products HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nname=x'),(SELECT 1 FROM (SELECT SLEEP(5))x),('\n\nDELETE /api/products HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for name and id; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V5 \u2014 Unauthenticated SQL Injection via unvalidated `id` in Rate model (UPDATE/DELETE)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Rate.php:67`  \n- **Entry point:** PATCH /api/rates (body id) and DELETE /api/rates (body id)  \n- **Prerequisite:** None (unauthenticated API)  \n- **Trigger chain:** $_REQUEST['id'] -> RateController::update/delete -> Rate::update/delete -> mysqli query \"... WHERE id=\" . $data['id'] / \"DELETE ... WHERE id='$id'\"  \n- **Proof of Concept:**  \n```\nDELETE /api/rates HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n\nPATCH /api/rates HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1 OR 1=1-- -&rate=1.0&date=2020-01-01\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for id; cast id to int; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V6 \u2014 Unauthenticated SQL Injection via unvalidated `id` in Stock model (UPDATE/DELETE)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Stock.php:68`  \n- **Entry point:** PATCH /api/stocks (body id) and DELETE /api/stocks (body id)  \n- **Prerequisite:** None (unauthenticated API)  \n- **Trigger chain:** $_REQUEST['id'] -> StockController::update/delete -> Stock::update/delete -> mysqli query \"... WHERE id=\" . $data['id'] / \"DELETE ... WHERE id='$id'\" (weight/purity/merchant_id/product_id are int-validated but id is not)  \n- **Proof of Concept:**  \n```\nDELETE /api/stocks HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n\nPATCH /api/stocks HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1 OR 1=1-- -&weight=1&purity=1&merchant_id=1&dop=2020-01-01 00:00:00\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for id; cast id to int; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V7 \u2014 Unauthenticated SQL Injection via unvalidated `id` in Transaction model (UPDATE/DELETE)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Transaction.php:69`  \n- **Entry point:** PATCH /api/transactions (body id) and DELETE /api/transactions (body id)  \n- **Prerequisite:** None (unauthenticated API)  \n- **Trigger chain:** $_REQUEST['id'] -> TransactionController::update/delete -> Transaction::update/delete -> mysqli query \"... WHERE id=\" . $data['id'] / \"DELETE ... WHERE id='$id'\"  \n- **Proof of Concept:**  \n```\nDELETE /api/transactions HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n\nPATCH /api/transactions HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1 OR 1=1-- -&weight=1&purity=1&rate_id=1\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for id; cast id to int; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V8 \u2014 Unauthenticated SQL Injection via unvalidated `id` in ItemsSold model (UPDATE/DELETE)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/ItemsSold.php:58`  \n- **Entry point:** PATCH /api/items_sold (body id) and DELETE /api/items_sold (body id)  \n- **Prerequisite:** None (unauthenticated API)  \n- **Trigger chain:** $_REQUEST['id'] -> ItemsSoldController::update/delete -> ItemsSold::update/delete -> mysqli query \"... WHERE id=\" . $data['id'] / \"DELETE ... WHERE id='$id'\"  \n- **Proof of Concept:**  \n```\nDELETE /api/items_sold HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n\nPATCH /api/items_sold HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1 OR 1=1-- -&stock_id=1&customer_id=1&employee_id=1&transaction_id=1&price=1&dos=2020-01-01\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for id; cast id to int; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V9 \u2014 Missing Authentication/Authorization on the entire REST API (broader than CVE-2025-14567)  \n- **CWE:** CWE-862  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `routes/ApiRoutes.php:25`  \n- **Entry point:** Any request to /api/* (login, users, customers, merchants, products, rates, stocks, transactions, items_sold, stockInfo, items_sold_info, tables)  \n- **Prerequisite:** None  \n- **Trigger chain:** ApiRoutes::invoke() calls ValidateRoutes::apiValidate() but NEVER Auth::userLogged(); all API controllers run without any session/auth check, exposing full CRUD + data read to unauthenticated attackers  \n- **Proof of Concept:**  \n```\nGET /api/customers HTTP/1.1\n(returns all customer records without any session cookie)\n\nGET /api/users HTTP/1.1\n(returns all user emails/admin flags unauthenticated)\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Call Auth::userLogged() at the start of ApiRoutes::invoke() and deny unauthenticated requests (except /api/login); apply per-role access control.  \n- **Dedup note:** PARTIAL  \n\n### V10 \u2014 Unauthenticated SQL Injection / Authentication Bypass in login via `password` (model/User.php valid())  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/User.php:14`  \n- **Entry point:** POST /api/login (password field)  \n- **Prerequisite:** None (login endpoint is unauthenticated)  \n- **Trigger chain:** LoginController::login validates password only by length (ValidateParams::password) -> User::valid() concatenates \"SELECT * FROM users WHERE email='$email' AND password='$pass'\" with unescaped $pass, allowing SQLi and auth bypass. CVE-2025-14568 names User.php args employee_id/id/admin; the login password argument is a distinct sink not enumerated there.  \n- **Proof of Concept:**  \n```\nPOST /api/login HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nemail=admin@x.com&password=x' OR '1'='1\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters in User::valid(); hash passwords (password_verify) instead of comparing raw input in SQL.  \n- **Dedup note:** PARTIAL  \n\n## Remediation\nUse prepared statements / parameterized queries (PDO or mysqli prepared statements) for all SQL; validate and allowlist order-by columns; enforce authentication on every sensitive endpoint.\n\n## Disclaimer\nThis report is provided for responsible disclosure. The findings were identified via static code analysis; runtime confirmation is recommended before public release.", "creation_timestamp": "2026-08-10T17:07:51.814424Z"}, {"uuid": "11d354bb-9f7b-49cd-99c8-06ea2af3d267", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-14568", "type": "seen", "source": "https://gist.github.com/qianqiusujiu/aac85c8baf201da8e39e56db374ad249", "content": "# Vulnerabilities in stock-management-system (haxxorsid/stock-management-system)\n\n**Product:** stock-management-system  \n**Vendor:** haxxorsid  \n**Repository:** https://github.com/haxxorsid/stock-management-system  \n**Affected version:** latest commit at time of audit (HEAD, shallow clone)  \n**Vulnerability types:** SQL Injection (CWE-89), Broken Access Control (CWE-862)  \n**Severity:** 10 High, 0 Medium  \n**Disclosure date:** 2026-08-11  \n\n## Summary\n\nstock-management-system is a small PHP web application. A code review identified 10 security issues (10 high, 0 medium) caused by untrusted user input reaching dangerous sinks without proper sanitization / parameterized queries.\n\n## Affected endpoints / root causes\n\n### V1 \u2014 Unauthenticated SQL Injection via unvalidated `id` in Customer model (UPDATE/DELETE)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Customer.php:60`  \n- **Entry point:** PATCH /api/customers (body id) and DELETE /api/customers (body id)  \n- **Prerequisite:** None (ApiRoutes::invoke performs no Auth::userLogged() check; endpoint is unauthenticated)  \n- **Trigger chain:** $_REQUEST['id'] -> CustomerController::update/delete -> Customer::update/delete -> mysqli query \"UPDATE customers ... WHERE id=\" . $data['id'] / \"DELETE ... WHERE id='$id'\"  \n- **Proof of Concept:**  \n```\nPATCH /api/customers HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1 OR 1=1-- -&name=Test&address=addr&email=a@b.com&phone=1234567890\n\nDELETE /api/customers HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for all id values (e.g. $stmt=$conn->prepare(\"DELETE FROM customers WHERE id=?\")); cast id to int; or enforce API authentication in ApiRoutes::invoke.  \n- **Dedup note:** CLEAN  \n\n### V2 \u2014 Unauthenticated SQL Injection via unvalidated `id` in Employee model (UPDATE/DELETE)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Employee.php:59`  \n- **Entry point:** PATCH /api/employees (body id) and DELETE /api/employees (body id)  \n- **Prerequisite:** None (ApiRoutes performs no authentication; note CVE-2025-14567 already covers the missing-auth of /api/employees, but the Employee-model SQLi sink itself is not covered by CVE-2025-14568 which names model/User.php)  \n- **Trigger chain:** $_REQUEST['id'] -> EmployeeController::update/delete -> Employee::update/delete -> mysqli query \"... WHERE id=\" . $data['id'] / \"DELETE ... WHERE id='$id'\"  \n- **Proof of Concept:**  \n```\nPATCH /api/employees HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1 OR 1=1-- -&name=Test&address=addr&phone=1234567890&gender=M&doj=2020-01-01\n\nDELETE /api/employees HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for id; cast id to int; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V3 \u2014 Unauthenticated SQL Injection via `id` and `address` in Merchant model (UPDATE/DELETE/INSERT)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Merchant.php:63`  \n- **Entry point:** PATCH /api/merchants (id), DELETE /api/merchants (id), POST /api/merchants (address)  \n- **Prerequisite:** None (unauthenticated API)  \n- **Trigger chain:** $_REQUEST['id'] -> Merchant::update/delete \"WHERE id=\" . $data['id'] / \"WHERE id='$id'\"; $_REQUEST['address'] only length-validated by ValidateParams::address (htmlspecialchars does not escape single quotes for SQL) -> Merchant::insert/update string-concatenated into SQL  \n- **Proof of Concept:**  \n```\nDELETE /api/merchants HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n\nPOST /api/merchants HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nname=Shop&address=x',(SELECT 1 FROM (SELECT SLEEP(5))x),'&email=a@b.com&phone=1234567890\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements; validate/cast id; escape or bind address; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V4 \u2014 Unauthenticated SQL Injection via unvalidated `name` (and `id`) in Product model  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Product.php:27`  \n- **Entry point:** POST /api/products (name), PATCH /api/products (name,id), DELETE /api/products (id)  \n- **Prerequisite:** None (unauthenticated API)  \n- **Trigger chain:** ValidateParams::productName only checks strlen<=35 (does NOT block single quotes) -> Product::insert \"INSERT INTO products (name) VALUES ('\" . $data['name'] . \"')\" / Product::update name / Product::delete id; all concatenated into mysqli query  \n- **Proof of Concept:**  \n```\nPOST /api/products HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nname=x'),(SELECT 1 FROM (SELECT SLEEP(5))x),('\n\nDELETE /api/products HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for name and id; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V5 \u2014 Unauthenticated SQL Injection via unvalidated `id` in Rate model (UPDATE/DELETE)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Rate.php:67`  \n- **Entry point:** PATCH /api/rates (body id) and DELETE /api/rates (body id)  \n- **Prerequisite:** None (unauthenticated API)  \n- **Trigger chain:** $_REQUEST['id'] -> RateController::update/delete -> Rate::update/delete -> mysqli query \"... WHERE id=\" . $data['id'] / \"DELETE ... WHERE id='$id'\"  \n- **Proof of Concept:**  \n```\nDELETE /api/rates HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n\nPATCH /api/rates HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1 OR 1=1-- -&rate=1.0&date=2020-01-01\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for id; cast id to int; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V6 \u2014 Unauthenticated SQL Injection via unvalidated `id` in Stock model (UPDATE/DELETE)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Stock.php:68`  \n- **Entry point:** PATCH /api/stocks (body id) and DELETE /api/stocks (body id)  \n- **Prerequisite:** None (unauthenticated API)  \n- **Trigger chain:** $_REQUEST['id'] -> StockController::update/delete -> Stock::update/delete -> mysqli query \"... WHERE id=\" . $data['id'] / \"DELETE ... WHERE id='$id'\" (weight/purity/merchant_id/product_id are int-validated but id is not)  \n- **Proof of Concept:**  \n```\nDELETE /api/stocks HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n\nPATCH /api/stocks HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1 OR 1=1-- -&weight=1&purity=1&merchant_id=1&dop=2020-01-01 00:00:00\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for id; cast id to int; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V7 \u2014 Unauthenticated SQL Injection via unvalidated `id` in Transaction model (UPDATE/DELETE)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Transaction.php:69`  \n- **Entry point:** PATCH /api/transactions (body id) and DELETE /api/transactions (body id)  \n- **Prerequisite:** None (unauthenticated API)  \n- **Trigger chain:** $_REQUEST['id'] -> TransactionController::update/delete -> Transaction::update/delete -> mysqli query \"... WHERE id=\" . $data['id'] / \"DELETE ... WHERE id='$id'\"  \n- **Proof of Concept:**  \n```\nDELETE /api/transactions HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n\nPATCH /api/transactions HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1 OR 1=1-- -&weight=1&purity=1&rate_id=1\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for id; cast id to int; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V8 \u2014 Unauthenticated SQL Injection via unvalidated `id` in ItemsSold model (UPDATE/DELETE)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/ItemsSold.php:58`  \n- **Entry point:** PATCH /api/items_sold (body id) and DELETE /api/items_sold (body id)  \n- **Prerequisite:** None (unauthenticated API)  \n- **Trigger chain:** $_REQUEST['id'] -> ItemsSoldController::update/delete -> ItemsSold::update/delete -> mysqli query \"... WHERE id=\" . $data['id'] / \"DELETE ... WHERE id='$id'\"  \n- **Proof of Concept:**  \n```\nDELETE /api/items_sold HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n\nPATCH /api/items_sold HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1 OR 1=1-- -&stock_id=1&customer_id=1&employee_id=1&transaction_id=1&price=1&dos=2020-01-01\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for id; cast id to int; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V9 \u2014 Missing Authentication/Authorization on the entire REST API (broader than CVE-2025-14567)  \n- **CWE:** CWE-862  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `routes/ApiRoutes.php:25`  \n- **Entry point:** Any request to /api/* (login, users, customers, merchants, products, rates, stocks, transactions, items_sold, stockInfo, items_sold_info, tables)  \n- **Prerequisite:** None  \n- **Trigger chain:** ApiRoutes::invoke() calls ValidateRoutes::apiValidate() but NEVER Auth::userLogged(); all API controllers run without any session/auth check, exposing full CRUD + data read to unauthenticated attackers  \n- **Proof of Concept:**  \n```\nGET /api/customers HTTP/1.1\n(returns all customer records without any session cookie)\n\nGET /api/users HTTP/1.1\n(returns all user emails/admin flags unauthenticated)\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Call Auth::userLogged() at the start of ApiRoutes::invoke() and deny unauthenticated requests (except /api/login); apply per-role access control.  \n- **Dedup note:** PARTIAL  \n\n### V10 \u2014 Unauthenticated SQL Injection / Authentication Bypass in login via `password` (model/User.php valid())  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/User.php:14`  \n- **Entry point:** POST /api/login (password field)  \n- **Prerequisite:** None (login endpoint is unauthenticated)  \n- **Trigger chain:** LoginController::login validates password only by length (ValidateParams::password) -> User::valid() concatenates \"SELECT * FROM users WHERE email='$email' AND password='$pass'\" with unescaped $pass, allowing SQLi and auth bypass. CVE-2025-14568 names User.php args employee_id/id/admin; the login password argument is a distinct sink not enumerated there.  \n- **Proof of Concept:**  \n```\nPOST /api/login HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nemail=admin@x.com&password=x' OR '1'='1\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters in User::valid(); hash passwords (password_verify) instead of comparing raw input in SQL.  \n- **Dedup note:** PARTIAL  \n\n## Remediation\nUse prepared statements / parameterized queries (PDO or mysqli prepared statements) for all SQL; validate and allowlist order-by columns; enforce authentication on every sensitive endpoint.\n\n## Disclaimer\nThis report is provided for responsible disclosure. The findings were identified via static code analysis; runtime confirmation is recommended before public release.", "creation_timestamp": "2026-08-10T17:07:51.876069Z"}]}