CVE-2025-12243 code-projects Client Details System GET Parameter welcome.php sql injection

Medium 5.3 Published 27 Oct 2025 Updated 27 Oct 2025

Remote attackers can exploit SQL injection in the welcome.php ID parameter to read or modify database contents.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-12243?

CVE-2025-12243 is a medium-severity SQL injection vulnerability in code-projects Client Details System, published on 27 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability was found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the file clientdetails/welcome.php of the component GET Parameter Handler. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.

Weakness: CWE-89, CWE-74

Which versions are affected by CVE-2025-12243?

It affects 1 product.

Products include Fabian Client Details System.

How do I fix CVE-2025-12243?

No fix published yet.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2025-12243 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-12243 exists.

Sources

Also known as BELL-CVE-2025-12243, GHSA-8m33-8c75-28hv.