Farm Management System CVE-2025-11478

Exploitation requires authenticated access to the application - an attacker must possess valid login credentials for the Farm Management System (PR:L per CVSS vector). The pid parameter in the /myCart.php file must be processed without input sanitization, which is confirmed by the CVE description. The /myCart.php endpoint must be accessible from the network from which the attacker is operating (AV:N). No non-default configuration is implied; exploitation is possible against standard, out-of-the-box deployments of version 1.0. The vulnerability does NOT require special privileges beyond basic user-level access (PR:L, not PR:N), making it exploitable by any authenticated user, including those with minimal role-based permissions.

Multiple signals present a conflicted risk picture. The CVSS v4 score of 2.1 reflects contained impact (VC:L, VI:L, VA:L with no scope elevation), but the EPSS percentile of 8% (0.03%) contradicts the availability of public exploit code. This discrepancy suggests the vulnerability is recognized by the security community yet exhibits minimal observable exploitation attempts in threat intelligence feeds. The requirement for authenticated access (PR:L) is a significant friction factor - attackers must already possess valid credentials, reducing the attack surface compared to unauthenticated SQL injection. CVSSv4 metric E:P indicates proof-of-concept availability confirmed. The practical risk hinges on whether Farm Management System instances are internet-exposed and whether credential compromise is a realistic precursor. In typical farm software deployments, which are often on-premises or behind firewalls, real-world attack likelihood remains low despite technical exploitability.

An authenticated user with login credentials (either legitimate account or compromised credential) accesses the Farm Management System and navigates to the myCart.php page. The attacker modifies the pid parameter in the URL or POST request with SQL injection payload, such as: pid=1' UNION SELECT database(),user(),version() -- -. The injected SQL executes within the application's database context, allowing the attacker to extract sensitive data from the database (credentials, farm data, user records) or modify records. Public exploit code from the referenced GitHub repository (https://github.com/DrNbnonono/CVE/issues/6) likely provides pre-built payloads to automate this process.