CVE-2025-0534 is a high SQL injection flaw (CVSS 7.3) in 1000 Projects Campaign Management System Platform for Women. The Username parameter of /Code/loginnew.php reaches a database query without safe handling. The record lists no fixed version, so treat it as unpatched, limit who can reach the app and fix the query.
What's affected
- Product: 1000 Projects Campaign Management System Platform for Women.
- Affected version in the record: 1.0.
- Location:
/Code/loginnew.php, parameterUsername. - Fixed version: none is listed in the NVD record or in the references provided with it. Check the project or vendor page for any update before you rely on one.
- The record says the exploit has been disclosed to the public. It is not listed in CISA KEV.
This product has other SQL injection CVEs in the same disclosure run. In the same run of CVE records they include CVE-2025-0533. If you run it, review every request handler, not only the one named here.
How to check if you're exposed
Start with inventory. If you did not install this application on purpose, find out who did. Small PHP apps like this often sit on a shared host or an old demo server and get forgotten.
- Look for the file on your servers. For example:
find /var/www -name "loginnew.php" 2>/dev/null. - Open the file and find where
Usernameis read from the request and where it ends up. If it is joined into an SQL string, the code is exposed. - Check web server access logs for requests to
/Code/loginnew.phpthat carry long, odd or error-producing values forUsername. Repeated requests from one address are worth a closer look. - Check your database logs for syntax errors that match those requests.
- Ask whether the app is reachable from the internet. The record says the attack can be launched remotely, so reachability matters.
Free scanning helps here too. You can check the open source packages an app pulls in with the free in-browser dependency scan, and browse related entries in the Gold directory. That covers dependencies, not custom query code, so the code review above still applies.
If you cannot identify the product from the file name, search your repositories and container images for the project name from the record.
What to do now
- Take the app off the public internet, or put it behind a VPN or an IP allow list, until the code is fixed.
- Check the project page for a newer release. The record lists none, so assume you must fix it yourself if you need to keep the app.
- Change the query that uses
Usernameto a prepared statement with bound parameters. A short example is shown below. - Run the database account with the least rights the app needs. It should not own the schema or read tables the app does not use.
- Rotate credentials stored in the database if you suspect the endpoint was probed, and review recent rows for changes you did not make.
- If you do not need the app, retire it and delete the data you no longer need.
The pattern to aim for looks like this, with a placeholder instead of string joining:
$stmt = $pdo->prepare("SELECT * FROM members WHERE id = :id");
$stmt->execute([':id' => $_POST['Username']]);
$row = $stmt->fetch();
Adjust the table and column names to your own schema. The point is that the value travels separately from the SQL text.
Why it matters
The weakness is CWE-89, a form of CWE-74. User input is placed into a database query in a way that lets it change the meaning of the query. The usual cause is building SQL by joining strings. The usual fix is bound parameters, plus server side validation of expected types.
The CVSS vector marks the attack as needing no privileges, so no account is required. The CVSS score is 7.3, which is high, but the impact depends on what the database holds and what the database account may do. Even a limited read or write can expose personal records or alter data that other staff trust. The record gives no fixed version and no vendor patch, so the effort to close this falls on whoever runs the app.
Quick check
Is there a patch for CVE-2025-0534?
The NVD record lists no fixed version and the references are public reports. Check the project or vendor page for updates. Until you find one, restrict access and fix the query yourself.
Is CVE-2025-0534 being exploited in the wild?
The record says an exploit has been disclosed to the public. It is not in the CISA Known Exploited Vulnerabilities catalog, and the record does not claim active exploitation.
Sources
These are the references listed in the record. The record and the public reports are the basis for this post.
Last reviewed: 19 October 2026.
