Is there a public PoC exploit available for CVE-2025-11478?

Yes, a public proof-of-concept exploit is available for CVE-2025-11478. Prioritise patching immediately. EPSS: 0.0%.

Farm Management System CVE-2025-11478

Q: What is the CVSS score of CVE-2025-11478?

CVE-2025-11478 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-08 cna@vuldb.com

PHP SQLi Farm Management System

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:33 vuln.today

DescriptionCVE.org

A weakness has been identified in SourceCodester Farm Management System 1.0. This issue affects some unknown processing of the file /myCart.php. This manipulation of the argument pid causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.

AnalysisAI

SQL injection in SourceCodester Farm Management System 1.0 allows authenticated remote attackers to manipulate the pid parameter in /myCart.php, enabling database queries with limited confidentiality and integrity impact. Public exploit code exists, though the EPSS score of 0.03% suggests minimal real-world exploitation despite the availability of proof-of-concept.

Technical ContextAI

The vulnerability resides in the /myCart.php endpoint of a PHP-based farm management application. The pid (product ID) parameter is processed without proper input validation or parameterized query mechanisms, allowing an attacker to inject arbitrary SQL commands. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection') classifies this as a classic injection flaw where user-controlled data flows unsanitized into SQL query construction. The CVSSv4 vector indicates network accessibility with low complexity but requires prior authentication (PR:L), limiting attack scope to logged-in users with low-level privileges.

RemediationAI

No vendor-released patch has been identified at time of analysis. Users of Farm Management System 1.0 should contact SourceCodester directly via www.sourcecodester.com to request a security update. Immediate compensating controls include: (1) restrict network access to /myCart.php to internal networks only, blocking external HTTP(S) traffic to this endpoint via firewall or web application firewall rules; (2) enforce strong authentication and limit user account creation to trusted administrators, reducing the pool of authenticated attackers; (3) implement input validation and SQL parameterization if source code is available (whitelist pid to numeric values only, use prepared statements); (4) enable SQL error suppression to prevent information leakage, and monitor database logs for SQL injection attempts (unusual quote characters, UNION keywords, or comment sequences in query logs). Consider upgrading to a maintained, actively-patched farm management system if a long-term solution is required.