SourceCodester Farm Management System CVE-2025-11487

Exploitation requires prior authentication to the SourceCodester Farm Management System - an unauthenticated remote attacker cannot directly exploit this vulnerability. The attacker must have valid user credentials or must compromise an existing account. The vulnerability is triggered by the /uploadProduct.php endpoint, which must be accessible to the authenticated user's role. No special non-default configuration is indicated in the CVE description; the flaw exists in the default code logic. The impact of SQL injection is also constrained by the database user's permissions and the system's error handling and logging practices.

Despite public exploit availability, real-world risk is low based on multiple converging signals. The CVSS 4.0 vector shows AV:N (network-accessible) but PR:L (requires authentication), limiting attack surface to already-authenticated users. The EPSS score of 0.04% (11th percentile) indicates minimal exploitation probability despite POC availability, suggesting this is a low-priority vulnerability in a niche farm management application with limited deployment. The impact scope is further constrained: VC:L/VI:L/VA:L indicate only low-level confidentiality, integrity, and availability impacts. The combination of required authentication, low impact rating, and low EPSS percentile suggests this vulnerability affects primarily development or test environments or systems already compromised at the application level. However, in environments where Farm Management System is internet-facing and accounts are compromised or shared, this could be a secondary exploitation vector.

An attacker with valid credentials to the Farm Management System logs in, navigates to the product upload functionality, and submits a crafted request to /uploadProduct.php with a malicious SQL injection payload in the Type parameter (e.g., Type=product' OR '1'='1). The injected SQL is executed server-side, allowing the attacker to extract user data, modify product records, or degrade system availability depending on database permissions.