CVE-2025-5401 is a High severity SQL injection flaw (CVSS 7.3) in chaitak-gorai Blogbook (versions up to commit 92f5cf90f8a7e6566b576fe0952e14e1c6736513), in /post.php. The record lists no fixed version, so treat the code as unpatched, keep it off the public internet, and change the query handling in your own copy.
What's affected
The record names chaitak-gorai Blogbook (versions up to commit 92f5cf90f8a7e6566b576fe0952e14e1c6736513) as affected. Blogbook is a rolling release, so the record names a commit rather than a version number, and says affected and updated releases are not available. The vulnerable input is the p_id value handled by /post.php.
The record does not list a patched release or a vendor advisory. Check the vendor site and the linked reports before you assume a newer download fixes it.
The record also says the exploit has been disclosed to the public, so assume that anyone who can reach the page can try it.
How to check if you're exposed
Start by finding out whether you run this software at all. Look for the file named in the record and for the p_id value in the source tree:
find . -name "post.php"
grep -rn "p_id" .
If the value is placed straight into a SQL string, the code has the weakness. If it is passed to a prepared statement with bound parameters, it does not. Then check your web server logs for odd requests to that file and for database errors that appear around the same times.
What to do now
- Take the chaitak-gorai Blogbook (versions up to commit 92f5cf90f8a7e6566b576fe0952e14e1c6736513) instance off the public internet, or put it behind a VPN or an IP allow list, until the code is fixed.
- Replace string concatenation for the p_id value with a prepared statement and bound parameters. Do the same for every other query in /post.php.
- Run the web application database account with the least privileges it needs. It should not own the schema or read tables it never uses.
- Search the logs and the database for signs of misuse, and rotate any credentials stored in the affected tables if you see any.
- Watch the https://gold.safeguard.sh/vulnerability/CVE-2025-5401 page and the vendor site for a patched release, and plan a move to maintained software if none arrives.
Why it matters
This is CWE-89 (SQL injection), filed under the broader CWE-74 injection class. This one is the public post page, which takes a post id from the URL. The record notes that the vendor was contacted early and did not respond.
The mechanism is old and well understood. The application builds a database query by pasting user input into a string, and the database cannot tell where the programmer's query ends and the visitor's text begins. The cure is just as old: parameterised queries, input checks as a second layer, and a database account that cannot do more than the page needs.
Projects like this one often ship the same pattern in many files. One fixed parameter rarely means the whole application is safe, so review every query rather than only the one in the report.
Quick check
Is there a patch for this CVE?
The record does not name one. Check the vendor site and the linked reports, and treat the product as unpatched until you confirm a fixed release.
Is this being exploited in the wild?
The record is not on the CISA Known Exploited Vulnerabilities list. It does say the exploit has been disclosed publicly, so exposure is still a real risk.
Sources
Last reviewed: 18 October 2026.
