External risk intelligence

SQL Injection Vulnerability in Fabian Online Complaint Site

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-63622

The vulnerable component is an online complaint site, which is typically deployed as a public-facing web application intended to be accessible by users over the internet to submit reports. As a web-based service with an administrative backend accessible via a web browser, it represents a commonly internet-facing attack surface.

SQL Injection

Fabian Online Complaint Site

1.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the Online Complaint Site software could allow attackers to inject malicious SQL code through a specific file, potentially leading to unauthorized access or modification of data. The main concern at this time is confirming if this software is in use and if it is exposed to the internet.

Enables unauthorized data access or changes.
Addresses potential unauthorized system access.
Confirm use and internet exposure.

Attack Path

How an attacker could exploit the issue

An attacker can target an online complaint site by sending a specially crafted request to the administrative section. Specifically, by manipulating the 'category' argument in the /cms/admin/subcategory.php file, they can trigger a vulnerability that allows them to inject malicious SQL commands. If successful, this could lead to unauthorized access, data modification, or disruption of the system.

Publicly accessible web application.
Manipulating a category argument in a PHP file.
Full system compromise.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in the code-projects Online Complaint Site could allow an attacker to inject malicious SQL commands. This manipulation affects the processing of the category argument in the /cms/admin/subcategory.php file, potentially leading to unauthorized access or modification of the underlying database when accessed.

Database integrity and availability at risk.
Malicious SQL commands injected via category parameter.
Unauthorized data access or system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The code-projects Online Complaint Site, specifically the `/cms/admin/subcategory.php` file, is vulnerable to SQL injection due to improper handling of the `category` argument. This critical vulnerability, accessible over the network with no user interaction required, allows for complete compromise of confidentiality, integrity, and availability. Identifying and securing this application is paramount.

Application owners must own this issue.
Verify public accessibility and business criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Fabian Online Complaint Site software?

The Fabian Online Complaint Site is a web-based application designed to manage user-submitted reports or grievances. It typically includes an administrative backend where authorized staff process these entries. As an interactive web system, it relies on server-side processing to organize and store complaint data in a backend database.

What does SQL injection mean for CVE-2025-63622?

This vulnerability is classified as CWE-89, which occurs when an application fails to properly sanitize user input before including it in database queries. In this case, an attacker can supply malicious SQL commands through the category argument. This allows the attacker to manipulate the database, potentially reading, changing, or deleting sensitive information stored by the application.

How is this SQL injection vulnerability triggered?

An attacker triggers the flaw by sending a specifically crafted HTTP request to the /cms/admin/subcategory.php file on the server. The vulnerability specifically involves manipulating the 'category' argument. It is important to note that actions performed outside of this specific file or using legitimate, non-malicious category inputs do not trigger the bug.

Why should I care about this if my system is internal?

Halo Surface Signal notes that this application is typically deployed as a public-facing web tool for user submissions. If your instance is exposed to the internet, it is at higher risk of unauthorized remote access. However, even if the application is currently hosted on an internal network, it remains vulnerable to any actor or compromised device that can reach the web server.

Do I need to patch my Online Complaint Site immediately?

Your first step is to confirm whether your organization is running version 1.0 of this software. If the application is in use, evaluate its current accessibility and business importance. Since this is a critical flaw that allows for potential full system compromise, prioritize restricting network access to the affected administrative file while planning for necessary security updates or configuration changes.

References

github.com/xmqaq/cve/issues/2

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.