CVE-2025-11057 is a high severity (CVSS 7.3) SQL injection flaw in SourceCodester Pet Grooming Management Software version 1.0. The ID parameter of print_inv.php reaches a database query unsafely. The record lists no fixed release, so take the app off the public internet, fix the query with prepared statements, or retire the software.
What's affected
The record names SourceCodester Pet Grooming Management Software version 1.0. The affected code is /admin/print_inv.php, where the ID input is handled unsafely. NVD scores it 7.3 (HIGH) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which means network reachable, low complexity, no privileges and no user interaction.
No fixed version is named in the NVD record or in the references it lists. Do not assume a later download is safe. Check the vendor page for a changelog, and compare the code before you trust it.
Weakness classes: CWE-74, CWE-89. The record says a public write-up exists, which is why this one is worth acting on even though the software is small.
How to check if you're exposed
First find out whether you run this software at all. Search your servers and repositories for the file, then look at how it builds its query.
find / -type f -name 'print_inv.php' 2>/dev/null
grep -rn "ID" --include=*.php . | head
If the input goes into a query string by concatenation, the code is exposed. Then check your web server access log for requests to print_inv.php from addresses you do not recognise, and for unusual characters in the ID value. Log paths vary by server, so use the one your stack writes to.
You can also run the free in-browser dependency scan at gold.safeguard.sh/scan on any manifest you have. Note that this kind of finding lives in application code, not in a package, so a manual look matters here.
What to do now
- Decide whether you still need this software. Small PHP projects like this often have no active maintainer, so check whether this one does.
- If you keep it, take it off the public internet. Put it behind a VPN or an IP allow list.
- Fix the query. Replace string concatenation with prepared statements, as in the sample below.
- Run the database account with the least rights it needs, so that a bug cannot read or change more than it should.
- Watch the vendor page and the NVD record for a patched release, and read the changelog before you upgrade.
- Review logs for the past weeks for odd requests to
print_inv.php.
$stmt = $pdo->prepare('SELECT * FROM items WHERE id = :id');
$stmt->execute([':id' => $_GET['id']]);
$rows = $stmt->fetchAll();
Why it matters
This is a classic injection bug. The code takes a request value and places it straight into a database command, so the database cannot tell data from instructions. CWE-74 is the general injection class, and CWE-89 is the SQL form of it.
Small PHP applications like this one are popular because they are free and quick to deploy. They are also often copied into real businesses with no review. That is how a sample project ends up on an internet facing server holding real records.
Quick check
Is a fixed version of Pet Grooming Management Software available?
The NVD record and its references do not name one. Check the vendor page, and treat any new download as unreviewed until you read the code.
Does a web application firewall fix this?
It can reduce the noise, but it does not repair the query. Use it as a stopgap and still fix the code with prepared statements.
Sources
- NVD record for CVE-2025-11057
- Reference listed in the record
- Reference listed in the record
- Safeguard Gold page for CVE-2025-11057
Last reviewed: 19 October 2026.
