Point of Sales
CVE-2025-12292
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-exposed /index.php endpoint
-
DeliveryCraft SQL injection payload in Username field
-
ExploitSubmit unauthenticated HTTP POST request
-
ExecutionManipulate backend SQL query logic
-
ImpactExtract database credentials or bypass authentication
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions are required for exploitation. The vulnerable parameter (Username) is located on the public-facing login form at /index.php, which is accessible to any unauthenticated user prior to authentication. No special configuration, feature flag, or authenticated session is needed. Exploitation is bounded only by network reachability to the web server - if the application is internet-exposed, it is exploitable by any actor. The primary limiting factor is the rarity of this specific application in production environments, as it is an educational/tutorial PHP script rather than commercial software. Authentication cannot bypass the vulnerability since the injection point is the authentication mechanism itself. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms unauthenticated, low-complexity network exploitation with no attack requirements - the most dangerous access profile for a web endpoint. However, the resulting score of 5.5 reflects limited impact scope (VC:L/VI:L/VA:L), meaning full compromise is not guaranteed from this single vector alone. EPSS at 0.03% (8th percentile) and absence from CISA KEV both suggest negligible real-world exploitation activity despite the POC being public. The practical risk is concentrated in organizations that deployed this application in production - primarily students, small retailers, or developers using SourceCodester scripts - rather than representing broad enterprise exposure. The E:P threat modifier in the provided vector confirms exploit code exists and is reproducible. Real-world prioritization should be low unless the application is internet-facing with live data. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP POST request to /index.php with a SQL payload such as ' OR '1'='1 in the Username field, causing the backend PHP application to construct a query that bypasses authentication logic or returns sensitive database rows. A public POC is available at https://github.com/J-Fy2767/CVE/issues/2 confirming this is reproducible. Given AC:L and PR:N, exploitation requires no prior reconnaissance beyond knowing the application is running. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 25, 2026
SQL injection in SourceCodester Point of Sales 1.0 exposes the login endpoint (/index.php) to unauthenticated remote exploitation via a malicious Username parameter, enabling database query manipulation. A public proof-of-concept exploit has been disclosed on GitHub (CVE/issues/2), confirming the attack is reproducible. EPSS sits at 0.03% (8th percentile), indicating limited observed exploitation in the wild despite POC availability - consistent with a niche, low-footprint product; no CISA KEV listing.
RemediationAI
No vendor-released patch has been identified at time of analysis for SourceCodester Point of Sales 1.0. The primary remediation is to replace the vulnerable SQL query construction in /index.php with PHP PDO or MySQLi prepared statements with parameterized queries, which eliminates the injection surface entirely. As an immediate compensating control, restrict network access to the application to trusted internal IP ranges only - this directly addresses the AV:N attack vector and is the highest-impact interim mitigation, though it prevents external legitimate use. Deploying a web application firewall (WAF) with SQL injection signatures can detect and block exploitation attempts but should not be treated as a permanent fix due to bypass risks. Disabling or taking the application offline is recommended if no development capacity exists to remediate the code. See VulDB entry https://vuldb.com/?id.329960 for additional context.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is a PHP-based point-of-sale web application distributed by janobe through SourceCodester (cpe:2.3:a:janobe:point_of_sales:1.0). The root cause is CWE-74 (Injection), specifically SQL injection, arising from unsanitized concatenation of user-supplied input into SQL queries within /index.php. The Username field on the login form is directly interpolated into a database query without parameterization or prepared statements, a classic PHP anti-pattern common in tutorial-grade code from educational code-sharing platforms like SourceCodester. An attacker can inject arbitrary SQL syntax to manipulate query logic, extract data, or bypass authentication.
Know when Point Of Sales gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Login form is pre-authentication (PR:N), network-reachable (AV:N), and yields partial database read/write and availability impact without scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was determined in SourceCodester Point of Sales 1.0. This vulnerability affects unknown code of the file /index.php. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
More in Point Of Sales
View allSQL injection in SourceCodester Point of Sales 1.0 (by janobe) via the Category parameter in /category.php allows remote
SQL injection in SourceCodester Point of Sales 1.0 via the ID parameter in /delete_category.php allows high-privilege re
Exploit-DB