E-Commerce Website CVE-2025-11511

CRITICAL: Exploitation requires valid supplier account authentication (PR:L). The vulnerability only triggers when a supplier with active login credentials accesses the /pages/supplier_add.php endpoint and submits a form with malicious input in the supp_email parameter. Unauthenticated remote attackers cannot exploit this without first obtaining supplier credentials through social engineering, credential stuffing, or compromise of a supplier account. The attack is NOT possible against default configurations of E-Commerce Website if no supplier accounts exist or if the /pages/supplier_add.php endpoint is not accessible without login.

This vulnerability presents a disconnect between raw CVSS score (2.1) and exploitation likelihood. The CVSS 4.0 vector shows AV:N (network), AC:L (low complexity), and E:P (proof-of-concept published), but PR:L (login required) is the critical limiting factor. EPSS percentile of 8% (0.03% probability) suggests this is NOT a high-exploitation-risk issue despite public POC availability - this likely reflects that real-world attackers prioritize unauthenticated or high-impact SQLi, and a supplier-facing administrative endpoint with limited data exposure is not a priority target. The low-impact scope (VC:L/VI:L/VA:L) means even successful exploitation does not grant broad database access. Security teams should deprioritize this below network-accessible unauthenticated SQLi, but it remains a valid remediation item for suppliers who have already authenticated.

An authenticated supplier account holder (or attacker with stolen supplier credentials) navigates to /pages/supplier_add.php and enters a crafted SQL injection payload in the supp_email field, such as admin'-- or admin' UNION SELECT passwords FROM users--. The unvalidated input is concatenated into a SQL query and executed, allowing the attacker to extract supplier or user account information from the database, or modify existing records.