CVE-2025-9840 is a medium SQL injection (6.3, CVSS 3.1) in itsourcecode Sports Management System 1.0. The code parameter in /Admin/gametype.php reaches a database query unsafely. We found no confirmed fixed release, so limit access to the app and rewrite the query with prepared statements.
What's affected
The record lists itsourcecode Sports Management System version 1.0 as affected. The description places the flaw in /Admin/gametype.php, through the code parameter, and says the attack can be started remotely.
The record gives a CVSS 3.1 base score of 6.3 (medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. In plain terms: reachable over the network, low complexity, a low privilege account needed, and limited impact on confidentiality, integrity and availability.
Fixed versions: none confirmed. The record names no patched release and links no vendor advisory. The researcher write-up we could read lists only the vulnerable version too. Check the project's download page before you assume anything has changed.
The record says the exploit has been made public. It is not in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is being exploited in the wild. A public write-up still lowers the effort for anyone who finds an instance, so do not wait on that distinction.
How to check if you're exposed
First, find out whether you run this software at all. Look for the /Admin/gametype.php path inside your web root, and check the app's own version string or download page for 1.0.
find /var/www -type f -path "*gametype.php" 2>/dev/null
grep -nE "mysqli_query|_POST|_GET|_REQUEST" /path/to/Admin/gametype.php
If the second command shows the value of code placed straight into a query string, the code matches the pattern the record describes. Then look at your web server access logs for requests to that file from addresses you do not recognise, for example by searching for the file name in the access log. Unusual database errors in the application log are worth reading as well.
This is a flaw in the application's own code, not in a package from a registry, so a dependency scan will not list it. The free in-browser dependency scan is still worth running on the same project to catch the packages it pulls in.
What to do now
- Take the app off the public internet if it does not need to be there. Put it behind a VPN or an IP allowlist.
- Remove or block access to /Admin/gametype.php at the web server or WAF until the code is fixed.
- Change the query behind the code parameter to a prepared statement with bound parameters, and validate the type of the value (a numeric id should be cast to an integer).
- Review every other query in the project the same way. Projects of this kind tend to repeat one query pattern across many files.
- Run the database account the app uses with the least rights it needs, so a bad query cannot read or change more than it should.
- Rotate any credentials stored in the database if you see signs of probing, and restore from a clean backup if data was altered.
- Watch the project page for a patched release and check the advisory before you upgrade.
Why it matters
The weakness classes are CWE-74 (injection) and CWE-89 (SQL injection). The researcher report we read says the value of code is used directly in a SQL query without cleaning or validation, which lets an attacker change the query that runs. The fix is old and well known: separate the query from the data.
Small PHP and MySQL sample projects like this are often downloaded and deployed as they are, with no maintainer watching for reports. That is why a confirmed fix may never arrive, and why the practical answer is containment plus a code change you make yourself.
Quick check
Is there a patched version of itsourcecode Sports Management?
We could not confirm one. Neither the record nor the pages we could read name a fixed release, so treat the app as unpatched and fix the query code yourself.
Is this being exploited in the wild?
The record says a public exploit exists, but the CVE is not in the CISA Known Exploited Vulnerabilities catalog and nothing we read reports active exploitation.
Sources
- Researcher write-up referenced by the record
- VulDB entry listed in the record (the page would not load for us, so nothing here relies on it)
- Gold vulnerability page
- Free in-browser dependency scan
Last reviewed: 18 October 2026.
