CVE-2025-4481 is a high severity SQL injection in SourceCodester Apartment Visitor Management System 1.0, in /search-result.php through the searchdata argument. The record says the exploit has been disclosed publicly and gives no fix. Do not run this sample application on a public server; patch the code or remove it.
What's affected
- Product: SourceCodester Apartment Visitor Management System, a small PHP sample application.
- Affected: version 1.0.
- Fixed version: none is stated in the record, and the vendor reference is a project listing rather than an advisory. Treat every copy of this code as vulnerable.
- Location:
/search-result.php, through thesearchdataargument. - Public exploit: the record says the exploit has been disclosed to the public and may be used.
- Severity: CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), rated High.
How to check if you're exposed
Applications like this are often downloaded as a zip, installed on a test server and then forgotten there. Look for it.
# find the vulnerable file on your web servers
find /var/www /srv /opt -name "search-result.php" 2>/dev/null
# check web logs for requests to it
grep -h "search-result.php" /var/log/nginx/access.log* /var/log/apache2/access.log* 2>/dev/null | head
If the file exists on a server that faces the internet, assume it has been probed, since the exploit details are public. Also check student, training and demo servers, which tend to run exactly this kind of code.
To see which of your projects pull in an affected component, run the free in-browser dependency scan at gold.safeguard.sh/scan. Reachability analysis then helps you separate libraries that your code actually calls from ones that only sit in a lockfile.
What to do now
- Remove the application from any public host. If you must keep it, put it behind a login at the web server.
- Fix the code by using prepared statements with bound parameters for every query that takes request data, not only this one.
- Run the database account used by the app with least privilege, and keep it separate from other databases on the server.
- Review the database and the web logs for unexpected queries, new rows or changed accounts.
- Run a static code scan over the project to find other queries built the same way.
Why it matters
The weakness is CWE-89, improper neutralization of special elements used in an SQL command, within CWE-74, the broader injection class. The page builds its query by placing the value of searchdata straight into the SQL text, so the database cannot tell data from instructions. The standard cure is a prepared statement with bound parameters.
Sample applications from code sharing sites are widely copied, and they tend to repeat the same query pattern on every page. That is why CVE lists often contain several entries for one project: fixing the page in the report leaves the rest. The record says the exploit has been disclosed to the public. It does not mark this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities list.
Quick check
Is there a patch?
The record gives no fixed version. Treat the code as unpatched and fix or remove it.
Why does this matter for a small sample app?
Copies of such code end up on real servers, and the exploit details are public, so scanners can find them.
Sources
Last reviewed: 18 October 2026.
