CVE-2025-12243
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A vulnerability was found in code-projects Client Details System 1.0. The file clientdetails/welcome.php in the GET Parameter Handler component is affected. Manipulation of the argument ID results in SQL injection. The attack can be initiated remotely and the exploit has been made public.
Risk Assessment
SQL injection can allow an attacker unauthorized access to the database, data theft, or modification. The organization risks data confidentiality and integrity.
Recommendation
Apply patches or disable the system until fixed. Conduct a security audit and use prepared statements.
Other vulnerabilities in Client Details System
See all- CVE-2025-12279Low
A vulnerability in code-projects Client Details System 1.0, affecting unknown code in the file /welcome.php. Such manipulation leads to cross-site scripting (XSS). The attack may be performed remotely. The exploit has been disclosed publicly.
- CVE-2025-11605Medium
A vulnerability in code-projects Client Details System 1.0 affects an unknown function in the file /admin/update-profile.php. Manipulation of the argument uid leads to SQL injection. The attack can be executed remotely. The exploit is publicly available and might be used.
Original NVD description (English source)
A vulnerability was found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the file clientdetails/welcome.php of the component GET Parameter Handler. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS