CVE-2025-10592: itsourcecode Online Public Access Catalog OPAC POST Parameter mysearch.php sql injection

Published Sep 17, 2025

Updated

A security vulnerability has been detected in itsourcecode Online Public Access Catalog OPAC 1.0. This impacts an unknown function of the file mysearch.php of the component POST Parameter Handler. Such manipulation of the argument searchfield/searchtext leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

Affected Software

2 affected components

itsourcecode Online Public Access Catalog OPAC

itsourcecode Online Public Access Catalog=1.0

Event History

Sep 17, 2025

CVE Published

via MITRE·01:02 PM

Data Sourced

via MITRE·01:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeaknessAffected Software

Dec 21, 58604

Event

via NVD·06:20 AM

Frequently Asked Questions

What is the severity of CVE-2025-10592?

CVE-2025-10592 is a critical vulnerability due to its potential for SQL injection, compromising database security.

How do I fix CVE-2025-10592?

To fix CVE-2025-10592, sanitize and parameterize the SQL queries in the mysearch.php file to prevent injection attacks.

What types of attacks are possible with CVE-2025-10592?

CVE-2025-10592 allows attackers to execute arbitrary SQL commands, potentially leading to data breaches and manipulation.

Which component is affected by CVE-2025-10592?

CVE-2025-10592 affects the POST Parameter Handler in the mysearch.php file of the Online Public Access Catalog OPAC 1.0.

Is CVE-2025-10592 present in earlier versions of Online Public Access Catalog?

CVE-2025-10592 specifically impacts Online Public Access Catalog OPAC version 1.0, and earlier versions may also be vulnerable.