Online Complaint Site CVE-2025-11552

Authentication with low-privilege credentials to the application is required; the exploit cannot be launched by unauthenticated remote attackers. The vulnerable endpoint /admin/category.php must be accessible (not blocked by firewall or network segmentation). The application must process the Category parameter and directly use it in SQL query construction without parameterization or input validation. Exploitation is limited to the database context of the application itself; attackers cannot gain system-level code execution or escape the database process.

This vulnerability presents minimal real-world risk despite public exploit availability. The CVSS v4.0 vector indicates authentication is required (PR:L), meaning only authenticated users with low privileges can exploit the vulnerability. The vector further shows limited impact scope: only the confidentiality, integrity, and availability of the application itself are affected (VC:L/VI:L/VA:L with SC:N/SI:N/SA:N indicating no scope expansion), meaning attackers cannot break out of the application context. The EPSS score of 0.03% (8th percentile) is notably low despite public POC availability, suggesting that this vulnerability lacks automation potential or practical exploitation conditions in real deployments. The attack complexity is low (AC:L) and does not require user interaction (UI:N), but the authentication barrier remains the critical limiting factor. This is a case where high-CVSS traditional metrics and public exploit code do not translate to significant real-world risk.

An authenticated user with low-privilege access to the admin panel crafts a malicious Category parameter containing SQL metacharacters (e.g., ' OR '1'='1) and sends a request to /admin/category.php. The application concatenates this unsanitized input directly into a SQL query, allowing the attacker to manipulate the query logic and potentially extract sensitive data from the database, such as other user credentials or complaint records.