CVE-2026-37431: Beauty Parlour Management System SQL Injection (CVSS 9.8)

Overview

A critical SQL injection vulnerability has been identified in Beauty Parlour Management System v1.1, a PHP-based appointment and salon management web application. The flaw, tracked as CVE-2026-37431, carries a CVSS v3.1 base score of 9.8 (Critical) and requires no authentication to exploit.

The vulnerability resides in the /appointment-detail.php endpoint, where the aptnumber parameter is passed directly to the SQL query without sanitization or parameterization. An attacker can submit a crafted SQL statement to extract, modify, or delete records from the underlying database.

Technical Details

Exploitation

The vulnerability is a classic error-based or UNION-based SQL injection in a GET or POST parameter. Because no authentication is required, any unauthenticated user with network access to the application can:

• Enumerate database names, tables, and columns
• Extract customer PII, appointment records, and payment information
• Retrieve admin credentials (hashed or plaintext)
• In some configurations, write files or execute OS commands via INTO OUTFILE or LOAD_FILE

Example of a vulnerable request pattern:

GET /appointment-detail.php?aptnumber=1' OR 1=1-- -

Tools such as sqlmap can fully automate database extraction against this endpoint with no special configuration.

Impact

Salon and beauty management systems typically store:

• Customer names, phone numbers, and email addresses
• Appointment histories and service records
• Staff information and access credentials
• Payment or invoice records

A successful exploitation could result in a full data breach of all records stored in the application's database, as well as potential lateral movement if database credentials are reused.

Remediation

1. Update immediately: Check with the software vendor or project maintainers for a patched release.
2. Use parameterized queries: Replace all dynamic SQL string concatenation with prepared statements using PDO or MySQLi.
3. Input validation: Enforce strict type-checking on numeric parameters such as aptnumber.
4. Web Application Firewall (WAF): Deploy a WAF rule to detect and block SQL injection payloads as a short-term mitigation.
5. Restrict network access: If the application is only needed internally, remove public internet exposure until patched.

References

• NVD Entry — CVE-2026-37431
• OWASP SQL Injection
• CWE-89: Improper Neutralization of Special Elements used in an SQL Command