CVE-2025-5207 is a medium severity (CVSS 4.7) SQL injection in SourceCodester Client Database Management System 1.0. The nickname/email argument handled by /superadmin_update_profile.php is passed into a database query unsafely, and the record says it can be attacked remotely. No fixed version is confirmed, so check with the vendor.
What's affected
SourceCodester Client Database Management System 1.0 is affected. The vulnerable code is /superadmin_update_profile.php, and the weak input is the nickname/email argument, per the record.
The record names no patched release. The references point to a VulDB entry and a researcher write-up, not a vendor advisory, so I cannot confirm that a fix exists. If you run this software, treat the affected version as vulnerable and check the vendor or project page for a newer build.
The CVSS vector lists a high privilege (administrator level) account as the access needed, so read the score with that in mind. The vulnerable page is the super admin profile update, and the vector lists a high privilege requirement, which is why the score is lower.
How to check if you're exposed
First find out whether you run it. Look for the product name in your application inventory and hosting accounts, and check for the file named above on any web server:
find /var/www -name "superadmin_update_profile.php" 2>/dev/null
If you have the source, search for the argument name near database calls and look for queries built by joining strings:
grep -rn "nickname" --include=*.php .
Then check the access logs for unusual requests to that path, such as very long values or SQL keywords in the parameter. Do not test live systems you do not own.
You can also run the free in-browser dependency scan at gold.safeguard.sh/scan, which checks the packages your own projects use against the Gold directory. It will not find a commercial product installed on a server, so pair it with an inventory of what runs where.
What to do now
- Confirm whether this product and version run anywhere in your estate, including forgotten demo or test sites.
- Check the vendor or project page for a fixed release. If there is none, plan to replace the software.
- Take the vulnerable page off the public internet. Put it behind a VPN or an allow list of known addresses.
- If you maintain the code, switch the query to a parameterized form so input is never part of the SQL text:
$stmt = $pdo->prepare('SELECT * FROM items WHERE name = :name');
$stmt->execute([':name' => $input]);
- Review database accounts used by the app and remove any rights it does not need, then review logs for the path above.
Why it matters
The weakness classes are CWE-74 (Injection), CWE-89 (SQL Injection). SQL injection happens when input is concatenated into a query, so the database cannot tell the developer's SQL from the user's data. It is one of the oldest and best understood bugs, and the cure is equally old: parameterized queries and least privilege database accounts.
The record says the exploit has been disclosed publicly. It does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild. Small packaged web apps like this often sit unmaintained on shared hosting, which is why public details matter even at a medium score.
Quick check
Is there a patched version of Client Database Mgmt System?
I could not confirm one. The record lists no fixed version and the references are not a vendor advisory, so check the vendor or project page and plan a replacement if nothing is offered.
What does the score of 4.7 tell me?
It is a medium rating. The vector shows a remote attack with low complexity and needing a high privilege (administrator level) account, with limited impact on confidentiality, integrity and availability. Your own exposure depends on whether the page is reachable.
Sources
Last reviewed: 18 October 2026.
