CVE-2025-11664 is a medium severity SQL injection flaw (CVSS 4.7) in Campcodes Online Beauty Parlor Management System version 1.0. Manipulating the searchdata argument in /admin/search-appointment.php lets a remote attacker change database queries. No fixed version is listed in the record, so patch the query code, restrict access, and check the vendor.
What's affected
Campcodes Online Beauty Parlor Management System is the affected product, specifically version 1.0. The weakness sits in /admin/search-appointment.php, where the searchdata argument feeds a database query. The record classes it under CWE-74 (Injection) and CWE-89 (SQL Injection).
The record gives a CVSS 4.7 score with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L. In plain terms, the attack runs over the network, needs low complexity, and needs no account, requires no user interaction. The record notes that the exploit has been disclosed publicly and may be used.
No fixed version is named in the record, and the record points to no vendor advisory or patch release. Treat every deployment of version 1.0 as exposed until the vendor says otherwise. Check the vendor site for a newer release before assuming a fix exists.
How to check if you're exposed
Start with inventory. Small applications like this are often installed by hand or left running on a test server that nobody remembers. Find out where Beauty Parlor Management runs in your environment.
On a web server you control, search the application directory for the affected file and the parameter named in the record:
find /path/to/app -name "search-appointment.php" 2>/dev/null
grep -rn "searchdata" /path/to/app | head
If the file is present and the query is built by joining strings, treat the code as vulnerable. Then review web server access logs for requests to that path with unusual or very long values in the parameter. Repeated errors from the database layer in your application log are another signal worth following up.
For a wider view, a dependency or application scan shows what else is deployed beside it. You can start with the free browser scan at gold.safeguard.sh/scan.
What to do now
-
Decide whether you need this application at all. If it is a demo, a student project, or a forgotten test site, take it offline.
-
If it must stay, remove it from direct internet exposure. Put it behind a VPN or an allowlist, or restrict the path named above at the web server.
-
Fix the code. Replace string concatenation in the affected query with a parameterised statement, and validate the input type (for example, cast an id to an integer).
-
Reduce what the application database account can do. It should not own the schema, read unrelated tables, or write files.
-
Rotate any credentials stored in that database if you cannot rule out misuse, and review recent logs.
-
Watch the vendor page and the record for a patch or an updated advisory, and re-test after any change.
Why it matters
This is a classic injection bug, tracked as CWE-74 (Injection) and CWE-89 (SQL Injection). The application takes a value from the request and places it inside a SQL statement without separating data from code. The database then reads part of that value as instructions. Depending on the account the application uses, the result can be data exposure, data changes, or deletion, which is why the vector in the record scores confidentiality, integrity and availability impact.
The record does not flag this CVE in the CISA Known Exploited Vulnerabilities catalog. That is not proof that nobody has tried it. The record does say the exploit is public, so plan as if attempts are possible.
If you ship or resell code like this, add a static scan and a pull request gate so a string built query cannot merge. To see whether a vulnerable package is hiding in your own projects, run the free in-browser dependency scan at gold.safeguard.sh/scan. The Gold directory lists the same advisories alongside affected versions, and reachability analysis helps you rank which findings are actually called by your code.
Quick check
Does a score of 4.7 mean this is minor?
Not on its own. The score assumes the vector in the record, and a public exploit raises the practical risk. If the application holds personal or payment data, treat it as urgent regardless of the number.
Is there a patch?
The record lists none, and there is no vendor advisory in it. Check the vendor site, and do not assume a fix exists until you see a release note that names this CVE or the affected file.
Sources
Last reviewed: 19 October 2026.
