SourceCodester Farm Management System CVE-2025-11486

Exploitation requires a valid authenticated user account on the Farm Management System - the CVSS vector PR:L (PR=L) mandates authenticated access. The vulnerability is triggered by sending a crafted HTTP request to /buyNow.php with a malicious SQL injection payload in the Name parameter. No special configuration or non-default settings are documented as prerequisites; the vulnerability affects the default application logic. Attackers must first obtain valid credentials, either through credential compromise, brute force (if weak credentials are in use), or insider access. The attack does not require elevated privileges beyond a standard user account. The vulnerability is limited to the /buyNow.php endpoint; other application endpoints may not be affected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) indicates network-exploitable SQL injection with low attack complexity and no user interaction required, but critically limited by PR:L (authenticated user required). The CVSS score of 2.1 reflects constrained impact - only Low for confidentiality, integrity, and availability. EPSS score of 0.03% (8th percentile) signals very low statistical likelihood of exploitation in the wild, contradicting the 'publicly available' POC status. This disconnect suggests the vulnerability affects a niche, self-hosted product with minimal attacker interest despite technical exploitability. The authentication requirement (PR:L) is a significant real-world barrier - casual attackers cannot exploit this without valid credentials. The combination of low EPSS, limited impact scope, and authentication dependency indicates this is lower priority than high-CVSS vulnerabilities without access controls, suitable for standard patching cycles rather than emergency response. However, insider threats (disgruntled users or staff with legitimate credentials) could leverage this to exfiltrate farm data.

An authenticated user of the Farm Management System navigates to /buyNow.php and crafts a malicious HTTP request with a SQL injection payload in the Name parameter, such as Name=product' UNION SELECT username,password FROM users--. The unsanitized parameter is concatenated into a SQL query, allowing the attacker to execute arbitrary SQL and extract sensitive data such as user credentials, financial records, or farm inventory information. The publicly available exploit code at https://github.com/DrNbnonono/CVE/issues/10 provides a proof-of-concept demonstrating this attack.