CVE-2025-3171 is a High severity (CVSS 7.3) SQL injection in Project Worlds Online Lawyer Management System 1.0, in the file /approve_lawyer.php through the unblock_id parameter. The record lists no fixed version. Treat the application as unpatched, restrict who can reach it, and replace the unsafe query with a parameterized one.
What's affected
The record covers Project Worlds Online Lawyer Management System version 1.0. The affected file is /approve_lawyer.php, and the manipulation of the unblock_id parameter leads to SQL injection. The description says the attack can be started remotely, and that the exploit has been disclosed to the public and may be used. It does not say the flaw is exploited in the wild, and the CVE is not in the CISA KEV list.
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. In that scoring, no account is needed to reach it. The weaknesses are CWE-74 (injection) and CWE-89 (SQL injection). Impact scores are low in each of confidentiality, integrity and availability, which is why the number stays below Critical.
The record names no fixed version and no vendor patch. The same product has other SQL injection entries from the same series of reports: CVE-2025-3170, CVE-2025-3172, CVE-2025-3173, CVE-2025-3174, CVE-2025-3175, CVE-2025-3176. If you run this software, fix them all in one pass.
How to check if you're exposed
Find out whether you run this software at all. Look for the vulnerable file on your web servers:
find /var/www -name "approve_lawyer.php" 2>/dev/null
If the file is there, read how it builds its query from the unblock_id value:
grep -n "unblock_id" $(find /var/www -name "approve_lawyer.php" 2>/dev/null)
A query assembled by joining a request value into the SQL text is the pattern behind this CVE. Then look at your web server access log for requests to the path:
grep "/approve_lawyer.php" /var/log/apache2/access.log | tail -n 50
Requests that include quote characters or SQL keywords in the value deserve a closer look. Adjust the log path for your server.
What to do now
- Check the vendor's site and the public report for a patched release. The record names none, so do not assume one exists.
- Take the application off the public internet, or put it behind a VPN, an IP allowlist or HTTP authentication until the code is fixed.
- Rewrite the query that uses the
unblock_idparameter in/approve_lawyer.phpto use prepared statements with bound values. Example:
$stmt = $con->prepare("SELECT * FROM records WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();
That is an illustration for a PHP and MySQL stack, with a stand in table name. Use the right type letter for each value, and apply the same change to every query in the file, not only the one named in the record. 4. Run the application's database account with the least privileges it needs. It should not own the schema or be able to read other databases. 5. Review access logs and database contents for signs of misuse, and rotate any credentials stored in the database if you see any.
Why it matters
SQL injection is one of the oldest and best understood web flaws, and it keeps appearing in small applications that build SQL by joining strings. The two weaknesses attached to this record are CWE-74 and CWE-89. The first is the general class of injection, where input changes the meaning of a command. The second is the specific case of an SQL command.
The fix is not clever. Use prepared statements with bound parameters for every query, validate the type of each input, and give the database account only the rights it needs. Source code projects of this kind are often downloaded as starting points or learning material, then deployed with little change. If that describes your Online Lawyer Management System installation, you own its security from the first day, and a code review for string built queries is the right next step.
A practical point for defenders: the record says a public exploit exists, so scanners and curious visitors can find the page fast. Even though the CVSS score is only 7.3, an internet facing page that talks to a database with customer or patient style records deserves the same care as a higher scored bug.
Quick check
Is there a patched version of Online Lawyer Management System?
The record lists no fixed version. Check the vendor's site and the public report, and if nothing is published, fix the query in /approve_lawyer.php yourself or take the application out of service.
Does the application need to be removed?
Not necessarily. If you cannot fix the code, limit who can reach it with a VPN, an IP allowlist or authentication, and use a least privilege database account.
Sources
Last reviewed: 19 October 2026.
