Is there a public PoC exploit available for CVE-2025-11487?

Yes, a public proof-of-concept exploit is available for CVE-2025-11487. Prioritise patching immediately. EPSS: 0.0%.

SourceCodester Farm Management System CVE-2025-11487

Q: What is the CVSS score of CVE-2025-11487?

CVE-2025-11487 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-08 cna@vuldb.com

PHP SQLi Farm Management System

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:03 vuln.today

DescriptionCVE.org

A security flaw has been discovered in SourceCodester Farm Management System 1.0. Affected by this issue is some unknown functionality of the file /uploadProduct.php. Performing manipulation of the argument Type results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.

AnalysisAI

SQL injection in SourceCodester Farm Management System 1.0 allows authenticated remote attackers to manipulate the Type parameter in /uploadProduct.php, resulting in limited confidentiality, integrity, and availability impact. The vulnerability has a low CVSS score (2.1) and EPSS score (0.04%) despite public exploit availability, indicating minimal real-world exploitation risk due to the requirement for prior authentication and constrained impact scope.

Technical ContextAI

The vulnerability exists in the PHP-based /uploadProduct.php endpoint of SourceCodester Farm Management System version 1.0, identified via CPE cpe:2.3:a:janobe:farm_management_system:1.0. The root cause is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), specifically SQL injection. The Type parameter fails to properly sanitize or parameterize user input before incorporation into SQL queries, allowing attackers to inject arbitrary SQL commands. This is a classic input validation flaw in legacy PHP applications that likely lacks prepared statements or input filtering mechanisms.

RemediationAI

No vendor-released patch has been identified at time of analysis. Organizations using Farm Management System 1.0 should contact the vendor (SourceCodester.com) to request a security update or migrate to a patched version if available. As interim mitigating controls, implement parameterized SQL queries or prepared statements in the /uploadProduct.php endpoint, apply strict input validation and whitelisting to the Type parameter, restrict network access to the /uploadProduct.php endpoint using network-based access controls, and enforce strong password policies and multi-factor authentication to reduce the risk of account compromise. Additionally, deploy a Web Application Firewall (WAF) configured with SQL injection detection rules to block malicious payloads targeting the Type parameter, though this should not be relied upon as the sole remediation.