code-projects E-Commerce Website CVE-2025-11597

Exploitation requires valid authentication credentials (user account) to access the /pages/product_add_qty.php endpoint, as indicated by PR:L in the CVSS vector. The application must be running version 1.0. The prod_id parameter must be injectable and reflected in a SQL query context without sanitization. Remote network access to the application is required (AV:N). No special application configuration, non-default settings, or specific deployment modes are indicated as necessary; the vulnerability exists by default in the affected version. The low attack complexity (AC:L) indicates that standard SQL injection techniques without obfuscation or timing attacks are likely effective.

Despite the CVSS 4.0 score of 2.1 suggesting low severity, several factors warrant closer examination. The EPSS score of 0.03% (8th percentile) indicates very low real-world exploitation probability, suggesting that attackers may not actively target this vulnerability at scale. However, authentication is required (PR:L in CVSS vector), which significantly limits attack surface compared to unauthenticated SQL injection - attackers must first obtain valid user credentials or compromise an existing session. The public availability of exploit code creates a tool-based risk for targeted attacks against specific deployments. The limited impact scope (VC:L, VI:L, VA:L with SC:N, SI:N, SA:N) indicates that even successful exploitation does not provide system-wide access or enable privilege escalation. This appears to be a low-risk vulnerability suitable for standard patching cycles rather than emergency response, particularly given the credential requirement and narrow impact.

An authenticated user or attacker who has obtained valid credentials sends a crafted HTTP request to /pages/product_add_qty.php with a malicious SQL injection payload in the prod_id parameter, such as prod_id=1' UNION SELECT database() -- . The unsanitized parameter is concatenated into a SQL query, causing the injected SQL to execute against the backend database. Depending on database permissions and query structure, the attacker could extract product pricing data, customer information, or other sensitive database contents.