E-Commerce Website CVE-2025-11509

Exploitation requires valid authentication credentials to access /pages/product_add.php; unauthenticated remote users cannot trigger the vulnerability. The prod_name parameter must be processed by a database query without parameterized statement protection. No special database configuration or non-default product settings are mentioned in available data, suggesting the vulnerability affects standard installations of E-Commerce Website 1.0. The impact is constrained to low-level data exposure and manipulation, indicating either the database user account has limited privileges or the application architecture restricts query scope.

This vulnerability presents a low real-world priority despite public exploit availability. The EPSS score of 0.03% (8th percentile) strongly contradicts the presence of public POC code, indicating exploitation is improbable in practice. The CVSS 4.0 vector reinforces this: authentication is required (PR:L), impact is limited to confidentiality, integrity, and availability (all marked Low), and scope is unchanged. The E:P (Exploit Maturity Proof-of-Concept) flag confirms public exploits exist but have not driven widespread real-world compromise. Attack complexity is low and no user interaction is required, meaning exploitation is technically feasible once access is gained, but the authentication barrier and limited impact substantially reduce organizational risk. Organizations should prioritize this below network-accessible, unauthenticated SQL injection flaws.

An authenticated user (e.g., low-privilege vendor account) navigates to /pages/product_add.php and submits a crafted SQL injection payload in the prod_name parameter (e.g., prod_name=test' OR '1'='1). The unsanitized input is concatenated into a SQL query, allowing the attacker to extract database records, modify product data, or degrade database availability depending on query context and database permissions.