CVE-2025-10841 is a high severity (CVSS 7.3) SQL injection flaw in code-projects Online Bidding System version 1.0. The ID parameter of weweee.php reaches a database query unsafely. The record lists no fixed release, so take the app off the public internet, fix the query with prepared statements, or retire the software.
What's affected
The record names code-projects Online Bidding System version 1.0. The affected code is /administrator/weweee.php, where the ID input is handled unsafely. NVD scores it 7.3 (HIGH) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which means network reachable, low complexity, no privileges and no user interaction.
No fixed version is named in the NVD record or in the references it lists. Do not assume a later download is safe. Check the vendor page for a changelog, and compare the code before you trust it.
Weakness classes: CWE-74, CWE-89. The record says a public write-up exists, which is why this one is worth acting on even though the software is small.
How to check if you're exposed
First find out whether you run this software at all. Search your servers and repositories for the file, then look at how it builds its query.
find / -type f -name 'weweee.php' 2>/dev/null
grep -rn "ID" --include=*.php . | head
If the input goes into a query string by concatenation, the code is exposed. Then check your web server access log for requests to weweee.php from addresses you do not recognise, and for unusual characters in the ID value. Log paths vary by server, so use the one your stack writes to.
You can also run the free in-browser dependency scan at gold.safeguard.sh/scan on any manifest you have. Note that this kind of finding lives in application code, not in a package, so a manual look matters here.
What to do now
- Decide whether you still need this software. Small PHP projects like this often have no active maintainer, so check whether this one does.
- If you keep it, take it off the public internet. Put it behind a VPN or an IP allow list.
- Fix the query. Replace string concatenation with prepared statements, as in the sample below.
- Run the database account with the least rights it needs, so that a bug cannot read or change more than it should.
- Watch the vendor page and the NVD record for a patched release, and read the changelog before you upgrade.
- Review logs for the past weeks for odd requests to
weweee.php.
$stmt = $pdo->prepare('SELECT * FROM items WHERE id = :id');
$stmt->execute([':id' => $_GET['id']]);
$rows = $stmt->fetchAll();
Why it matters
This is a classic injection bug. The code takes a request value and places it straight into a database command, so the database cannot tell data from instructions. CWE-74 is the general injection class, and CWE-89 is the SQL form of it.
The fix is not exotic. Prepared statements with bound parameters keep input and command apart, and they have been standard practice for years. The harder part is that code like this often has the same mistake in many files, so one fixed page rarely means a safe app.
Quick check
Is a fixed version of Online Bidding System available?
The NVD record and its references do not name one. Check the vendor page, and treat any new download as unreviewed until you read the code.
Does a web application firewall fix this?
It can reduce the noise, but it does not repair the query. Use it as a stopgap and still fix the code with prepared statements.
Sources
- NVD record for CVE-2025-10841
- Reference listed in the record
- Reference listed in the record
- Safeguard Gold page for CVE-2025-10841
Last reviewed: 19 October 2026.
