Simple Inventory System CVE-2025-11611

Exploitation requires valid authentication credentials to access the application (PR:L in CVSS vector). The SQL injection must be present in the /user.php endpoint specifically in the uemail parameter processing logic. No special system configuration or non-default settings are explicitly required beyond the application being deployed and accessible to the attacker. The vulnerability is limited to read and low-impact modification of user-level data; system-level compromise or denial of service is not possible from this injection point based on the constrained impact indicators (VC:L, VI:L, VA:L, SC:N, SI:N, SA:N).

CVSS 2.1 with PR:L (login required) and limited impact scope (VC:L, VI:L, VA:L, SC:N, SI:N, SA:N) indicates this is a low-severity authenticated SQL injection. The EPSS percentile of 8% is significantly below median, suggesting minimal real-world exploitation despite public POC availability. This discrepancy reflects that practical exploitation requires: (1) valid login credentials, (2) application must be deployed with SQL injection exposure in /user.php, and (3) attacker motivation limited to reading/modifying low-value user data within the application database. CVSS vector confirms attack vector is network (AV:N) with low complexity (AC:L), but authentication barrier and constrained impact reduce practical risk. Active exploitation is not confirmed by CISA KEV; POC exists but exploitation remains theoretical unless combined with credential compromise.

An authenticated attacker with valid login credentials submits a crafted SQL injection payload in the uemail parameter (e.g., user@example.com' UNION SELECT password FROM admin_users--) to the /user.php endpoint via HTTP POST or GET request. The unsanitized parameter is concatenated into a SQL query, allowing the attacker to extract sensitive data such as usernames, passwords, or other records from the application database without additional privilege escalation.