SourceCodester Farm Management System CVE-2025-11487
LOWCVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionNVD
A security flaw has been discovered in SourceCodester Farm Management System 1.0. Affected by this issue is some unknown functionality of the file /uploadProduct.php. Performing manipulation of the argument Type results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.
AnalysisAI
SQL injection in SourceCodester Farm Management System 1.0 allows authenticated remote attackers to manipulate the Type parameter in /uploadProduct.php, resulting in limited confidentiality, integrity, and availability impact. The vulnerability has a low CVSS score (2.1) and EPSS score (0.04%) despite public exploit availability, indicating minimal real-world exploitation risk due to the requirement for prior authentication and constrained impact scope.
Technical ContextAI
The vulnerability exists in the PHP-based /uploadProduct.php endpoint of SourceCodester Farm Management System version 1.0, identified via CPE cpe:2.3:a:janobe:farm_management_system:1.0. The root cause is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), specifically SQL injection. The Type parameter fails to properly sanitize or parameterize user input before incorporation into SQL queries, allowing attackers to inject arbitrary SQL commands. This is a classic input validation flaw in legacy PHP applications that likely lacks prepared statements or input filtering mechanisms.
RemediationAI
No vendor-released patch has been identified at time of analysis. Organizations using Farm Management System 1.0 should contact the vendor (SourceCodester.com) to request a security update or migrate to a patched version if available. As interim mitigating controls, implement parameterized SQL queries or prepared statements in the /uploadProduct.php endpoint, apply strict input validation and whitelisting to the Type parameter, restrict network access to the /uploadProduct.php endpoint using network-based access controls, and enforce strong password policies and multi-factor authentication to reduce the risk of account compromise. Additionally, deploy a Web Application Firewall (WAF) configured with SQL injection detection rules to block malicious payloads targeting the Type parameter, though this should not be relied upon as the sole remediation.
Share
External POC / Exploit Code
Leaving vuln.today