CVE-2025-9691 covers a high severity (CVSS 7.3) SQL injection in /login.php in Campcodes Online Shopping System 1.0. Because the Password argument is not handled safely, a remote request can alter the query. The exploit is public and the record names no fix, so restrict access and parameterize the query.
What's affected
The record lists Campcodes Online Shopping System version 1.0. The vulnerable code is /login.php, and the affected input is Password. The description says the attack can be carried out remotely and that the exploit has been disclosed publicly.
No fixed version appears in the record, and none of the pages I could reach named one. If the project later publishes a patched release, the maintainer's page is the place to confirm it. Until then, treat every deployed copy of version 1.0 as exposed.
The weakness is classed as CWE-89 (SQL injection) under the broader CWE-74 (injection) family. The record scores it 7.3 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L: network reachable, low complexity, no privileges and no user interaction, with low impact on confidentiality, integrity and availability.
How to check if you're exposed
Start with inventory. Work out whether you run Online Shopping System at all, and which version. Then look for the file the record names.
find /var/www -type f -name "login.php"
Adjust the path to wherever your web root lives. A hit on a copy of version 1.0 means the code is present. Next, check reachability: is the application open to the internet, or only to an internal network?
For signs of abuse, read the web server access log for requests to the affected path. Look for odd characters, SQL keywords and unusually long values:
grep -E "login\.php" /var/log/apache2/access.log | tail -n 100
Access logs show the URL and query string but usually not POST bodies, so also read the PHP and database error logs for query syntax errors and sudden bursts of failures. The free dependency scan at gold.safeguard.sh/scan covers libraries you declare, so it will not see a flaw inside application code you downloaded or wrote yourself. For that, a code scan is the right tool.
What to do now
- Find every deployment of Online Shopping System 1.0, including test and demo copies that were never meant to be public.
- Take the application off the open internet, or put it behind a VPN, an IP allowlist or web server authentication until the code is fixed.
- Replace string built queries in
login.phpwith prepared statements and bound parameters (mysqli or PDO in PHP), and validate the type ofPasswordbefore it gets near the database. - Run the application's database account with the least privilege it needs: no administrative rights and no access to other schemas.
- Review access and error logs for the affected path, and rotate database and application credentials if you see signs of abuse.
- Check the project page now and then for a patched release, and retire the application if it is unmaintained.
Why it matters
The cause is untrusted input reaching a query without parameter binding. That single habit produces a large share of web application flaws, and it keeps appearing in small projects where each page builds its own query by hand.
A shop login page is public by design, and the database behind it holds customer accounts and orders. Fixing one page is not enough if the same habit runs through the codebase. Check the sibling pages that read the same kinds of values.
The CVE is not in the CISA Known Exploited Vulnerabilities catalog according to the record. The record does state that a public exploit exists, which is a reason to move quickly on any internet facing copy.
Try it yourself
This walkthrough shows how a finding like this is surfaced and triaged in a scan.
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch for CVE-2025-9691?
The record names no fixed version, and I could not confirm one from the pages I reached. Check the project page, and meanwhile restrict access and fix the query in your own copy.
Do I need to be logged in to exploit CVE-2025-9691?
The vector in the record has no privileges required and no user interaction, so it is treated as reachable by a remote visitor. Confirm against your own deployment, since a login wall you added may change the picture.
Sources
- Public report cited by the record: https://github.com/lrjbsyh/CVE_Hunter/issues/6
- Safeguard Gold entry: CVE-2025-9691
- CVE record fields (description, CVSS score and vector, CWE, product, published date) as held in the Safeguard CVE record
Last reviewed: 18 October 2026.
