SourceCodester Simple Inventory System CVE-2025-11610

Exploitation requires an authenticated user account with permissions to access the brand management functionality in SourceCodester Simple Inventory System 1.0. The attacker must have network access to the application and valid login credentials (PR:L in CVSS vector confirms authentication is mandatory). Non-default configuration is not explicitly required - the vulnerability exists in standard brand management features. Unauthenticated remote exploitation is NOT possible; the authenticated requirement significantly constrains the realistic attack surface and limits this to insider threats or compromised user accounts.

This is a low-priority vulnerability despite public POC availability. CVSS 2.1 combined with EPSS 0.03% (8th percentile) indicates minimal real-world exploitation risk. The discrepancy between public POC and negligible EPSS suggests this is likely a proof-of-concept in an obscure or legacy application rather than an actively exploited flaw. The authenticated requirement (PR:L) is a critical limiting factor - attackers must already have valid credentials, reducing the threat surface significantly. The scope is unchanged (S:X not set to S:C), meaning impact is confined to the vulnerable component without cross-boundary effects. For organizations running this legacy inventory system, patch immediately; for others, this does not warrant urgent action.

An authenticated user with legitimate access to the Simple Inventory System modifies the editBrandName parameter in a request to /brand.php, injecting SQL commands such as ' OR '1'='1 to manipulate the query logic. The attacker could extract sensitive data from the database (product information, pricing, user records) or potentially modify database contents to corrupt inventory records. The publicly available POC from GitHub (https://github.com/yihaofuweng/cve/issues/52) provides working examples of this injection technique.