A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26. The username and password parameters are vulnerable to SQL injection, allowing unauthenticated attackers to bypass authentication completely. Successful exploitation grants full administrative access to the application, including the ability to manipulate the public-facing website content (HTML/DOM manipulation).
References
| Link | Resource |
|---|---|
| https://github.com/onurcangnc/CVE-2025-10878-AdminPandov1.0.1-SQLi | Exploit Third Party Advisory |
| https://onurcangenc.com.tr/posts/cve-2025-10878-sql-authentication-bypass-in-fikir-odalar%C4%B1-adminpando/ | Exploit Third Party Advisory |
| https://onurcangenc.com.tr/posts/cve-2025-10878-sql-authentication-bypass-in-fikir-odalar%C4%B1-adminpando/ | Exploit Third Party Advisory |
Configurations
History
12 Feb 2026, 17:37
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:omran:fikir_odalari_adminpando:*:*:*:*:*:*:*:* | |
| First Time |
Omran
Omran fikir Odalari Adminpando |
|
| References | () https://github.com/onurcangnc/CVE-2025-10878-AdminPandov1.0.1-SQLi - Exploit, Third Party Advisory | |
| References | () https://onurcangenc.com.tr/posts/cve-2025-10878-sql-authentication-bypass-in-fikir-odalar%C4%B1-adminpando/ - Exploit, Third Party Advisory |
04 Feb 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://onurcangenc.com.tr/posts/cve-2025-10878-sql-authentication-bypass-in-fikir-odalar%C4%B1-adminpando/ - |
03 Feb 2026, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-03 20:15
Updated : 2026-02-12 17:37
NVD link : CVE-2025-10878
Mitre link : CVE-2025-10878
CVE.ORG link : CVE-2025-10878
JSON object : View
Products Affected
omran
- fikir_odalari_adminpando
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')