CVE-2025-10068 is a high severity SQL injection (CVSS 7.3) in itsourcecode Online Discussion Forum 1.0, in the file /admin/admin_forum/add_views.php through the ID argument. The record lists no fixed version. Until the vendor publishes one, limit who can reach the application, review logs for abuse, and replace string-built queries with parameterized ones.
What's affected
The NVD record names itsourcecode Online Discussion Forum 1.0 from itsourcecode. The weak spot is the file /admin/admin_forum/add_views.php, where the ID argument reaches a database query without safe handling. The weakness is classed as CWE-89, SQL injection, which sits under CWE-74, improper neutralization of special elements in output used by a downstream component.
The record was published on 2025-09-07 and scores 7.3 (HIGH). The vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reads as network reachable, low attack complexity, no privileges and no user interaction. Impact on confidentiality is limited, on integrity limited, and on availability limited.
The record does not list a fixed version, and I could not confirm one from the vendor. If a newer release exists, the vendor site is the place to find it, so check it before assuming you are stuck on the vulnerable build. Treat any copy of the product at the listed version as exposed until you have evidence otherwise.
The file lives under an admin path. The vector shows what privileges the scorer assumed, so read it alongside your own access controls.
How to check if you're exposed
This product is a self-hosted web application, not a package you pull from a registry, so there is no single command that lists it. Work through these checks.
- Find every copy. Search your web roots and repositories for the file name.
find /var/www -name "add_views.php" 2>/dev/null
- Confirm the product and version from its own documentation, footer or release notes, and compare against the version in the record.
- Check whether the application is reachable from the internet or only from an internal network.
- Search your web server access logs for requests to the affected file that carry unusual characters or SQL keywords in the
IDvalue.
grep "add_views.php" /var/log/apache2/access.log | grep -iE "union|select|sleep|%27"
A hit is a lead, not proof. Many scanners and bots produce similar noise. A clean result does not prove safety either, because logs may have rotated or the request may have been a POST with the value in the body.
What to do now
- Check the vendor site for a release newer than 1.0, and read its notes for this issue. The record does not confirm a fix.
- If you cannot patch, take the application off the public internet. Put it behind a VPN or an IP allowlist.
- If you maintain the code, switch the query behind
/admin/admin_forum/add_views.phpto a prepared statement with bound parameters, and validate theIDinput against the type you expect. - Run the database account for this application with the minimum rights it needs, so a successful injection reaches as little as possible.
- Review logs and the database for signs of misuse, and rotate any credentials stored in tables this application can read.
- Scan your code and dependencies for the same pattern. The free in-browser dependency scan and the Gold directory help you see what else in your stack carries known issues.
Why it matters
SQL injection happens when user input is joined into a query string, so the database treats part of the input as instructions. The fix is old and well understood: send the query and the values separately. Small PHP and similar projects often skip that step, and the same mistake tends to repeat across many files in one codebase.
The record says the exploit has been disclosed publicly. It is not marked as exploited in the wild by CISA's Known Exploited Vulnerabilities list, and I did not find a statement of active exploitation. Public disclosure still lowers the effort needed to try it, which is why exposed copies deserve attention soon. Reachability matters here: an instance that only your staff can open is a much smaller problem than one on the internet.
Quick check
Is there a patch for CVE-2025-10068?
The record does not list a fixed version, and I could not confirm one. Check the vendor site, and until you find a patch, restrict access to the application.
Is CVE-2025-10068 exploited in the wild?
The record is not flagged in the CISA Known Exploited Vulnerabilities list, and I found no advisory that says it is. It does say the exploit was disclosed publicly, so assume it can be tried.
Sources
The NVD record for CVE-2025-10068 and the references it lists (these were not independently verified, and the vendor page should be checked for fixes):
- https://github.com/JunGu-W/cve/issues/13
- https://itsourcecode.com/
- https://vuldb.com/?ctiid.322991
- https://vuldb.com/?id.322991
- https://vuldb.com/?submit.644077
Last reviewed: 19 October 2026.
