Web-Based Inventory and POS System
CVE-2025-11424
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote SQL injection with no authentication; low integrity, confidentiality, and availability impact due to SQLi scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in code-projects Web-Based Inventory and POS System 1.0. This impacts an unknown function of the file /login.php. Executing manipulation of the argument emailid can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
AnalysisAI
Unauthenticated SQL injection in code-projects Web-Based Inventory and POS System 1.0 allows remote attackers to manipulate the emailid parameter on login.php, potentially leading to data theft, authentication bypass, or database corruption. Public exploit code is available, but EPSS indicates a low probability of exploitation (0.03%). No vendor patch has been identified.
Technical ContextAI
The vulnerability lies in /login.php, a PHP endpoint that directly incorporates user-supplied emailid into a SQL query without sanitization, leading to improper neutralization of special elements (CWE-74). The affected product, Web-Based Inventory and POS System 1.0 (CPE: cpe:2.3:a:fabian:web-based_inventory_and_pos_system:1.0), is a PHP/MySQL application distributed by code-projects.org, likely used for small-scale inventory and point-of-sale tasks.
RemediationAI
No vendor-released patch is available. As a temporary mitigation, restrict access to /login.php to trusted IP addresses or disable the page entirely. For a structural fix, manually sanitize the emailid parameter using prepared statements in the PHP code, though such custom modifications are error-prone. Monitor the VulDB advisory (https://vuldb.com/?id.327359) for any forthcoming official update, and consider migrating to a supported alternative inventory/POS system.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today