Is there a public PoC exploit available for CVE-2025-11486?

Yes, a public proof-of-concept exploit is available for CVE-2025-11486. Prioritise patching immediately. EPSS: 0.0%.

SourceCodester Farm Management System CVE-2025-11486

Q: What is the CVSS score of CVE-2025-11486?

CVE-2025-11486 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-08 cna@vuldb.com

PHP SQLi Farm Management System

2.1

CVSS 4.0

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:03 vuln.today

DescriptionNVD

A vulnerability was identified in SourceCodester Farm Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /buyNow.php. Such manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in SourceCodester Farm Management System 1.0 allows authenticated remote attackers to manipulate the Name parameter in /buyNow.php, enabling data exfiltration or modification with limited impact. The vulnerability is exploitable via network access without elevated privileges, publicly available exploit code exists, but real-world risk remains low due to authentication requirement and constrained scope (limited confidentiality, integrity, and availability impact per CVSS4.0 scoring).

Technical ContextAI

The vulnerability resides in improper input validation of the Name parameter within /buyNow.php, a PHP-based endpoint in the Farm Management System web application. CWE-74 (Improper Neutralization of Special Elements in Output) indicates the application fails to sanitize or parameterize SQL queries, allowing attackers to inject arbitrary SQL commands. The affected product is identified by CPE cpe:2.3:a:janobe:farm_management_system:1.0:*:*:*:*:*:*:*, suggesting the vulnerability is specific to version 1.0 of the janobe vendor's Farm Management System. The weakness is typical of legacy PHP applications that concatenate user input directly into SQL queries without prepared statements or input escaping.

RemediationAI

No vendor-released patch identified at time of analysis. Implement immediate compensating controls: (1) Apply input validation to the Name parameter in /buyNow.php using a whitelist of allowed characters and rejecting SQL metacharacters (semicolon, single quote, double quote, dash-dash, forward slash); (2) Implement parameterized SQL queries (prepared statements) in PHP using mysqli or PDO with bound parameters to prevent SQL injection; (3) Restrict database user account permissions so the application account used by /buyNow.php has SELECT-only access where possible, limiting damage from successful injection; (4) Disable the /buyNow.php endpoint entirely if not actively in use, or restrict access via IP whitelist to authorized users only; (5) Monitor database logs for suspicious SQL patterns such as UNION-based queries or comment sequences. Contact SourceCodester vendor at https://www.sourcecodester.com/ for patch availability or to request security fixes, as this appears to be legacy software without active maintenance.

CVE-2025-11486 vulnerability details – vuln.today

Back