Is there a public PoC exploit available for CVE-2025-12292?

Yes, a public proof-of-concept exploit is available for CVE-2025-12292. Prioritise patching immediately. EPSS: 0.0%.

Point of Sales CVE-2025-12292

Q: What is the CVSS score of CVE-2025-12292?

CVE-2025-12292 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-27 cna@vuldb.com

PHP SQLi Point Of Sales Janobe

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Login form is pre-authentication (PR:N), network-reachable (AV:N), and yields partial database read/write and availability impact without scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:11 vuln.today

CVE Published

Oct 27, 2025 - 16:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was determined in SourceCodester Point of Sales 1.0. This vulnerability affects unknown code of the file /index.php. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in SourceCodester Point of Sales 1.0 exposes the login endpoint (/index.php) to unauthenticated remote exploitation via a malicious Username parameter, enabling database query manipulation. A public proof-of-concept exploit has been disclosed on GitHub (CVE/issues/2), confirming the attack is reproducible. EPSS sits at 0.03% (8th percentile), indicating limited observed exploitation in the wild despite POC availability - consistent with a niche, low-footprint product; no CISA KEV listing.

Technical ContextAI

The affected product is a PHP-based point-of-sale web application distributed by janobe through SourceCodester (cpe:2.3:a:janobe:point_of_sales:1.0). The root cause is CWE-74 (Injection), specifically SQL injection, arising from unsanitized concatenation of user-supplied input into SQL queries within /index.php. The Username field on the login form is directly interpolated into a database query without parameterization or prepared statements, a classic PHP anti-pattern common in tutorial-grade code from educational code-sharing platforms like SourceCodester. An attacker can inject arbitrary SQL syntax to manipulate query logic, extract data, or bypass authentication.

RemediationAI

No vendor-released patch has been identified at time of analysis for SourceCodester Point of Sales 1.0. The primary remediation is to replace the vulnerable SQL query construction in /index.php with PHP PDO or MySQLi prepared statements with parameterized queries, which eliminates the injection surface entirely. As an immediate compensating control, restrict network access to the application to trusted internal IP ranges only - this directly addresses the AV:N attack vector and is the highest-impact interim mitigation, though it prevents external legitimate use. Deploying a web application firewall (WAF) with SQL injection signatures can detect and block exploitation attempts but should not be treated as a permanent fix due to bypass risks. Disabling or taking the application offline is recommended if no development capacity exists to remediate the code. See VulDB entry https://vuldb.com/?id.329960 for additional context.