Is there a public PoC exploit available for CVE-2025-12293?

Yes, a public proof-of-concept exploit is available for CVE-2025-12293. Prioritise patching immediately. EPSS: 0.0%.

SourceCodester Point of Sales CVE-2025-12293

Q: What is the CVSS score of CVE-2025-12293?

CVE-2025-12293 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-27 cna@vuldb.com

PHP SQLi Point Of Sales Janobe

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable endpoint, no auth or interaction required; limited C/I/A reflects partial data read/write, not full DB control or system takeover.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:12 vuln.today

CVE Published

Oct 27, 2025 - 16:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was identified in SourceCodester Point of Sales 1.0. This issue affects some unknown processing of the file /category.php. Such manipulation of the argument Category leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in SourceCodester Point of Sales 1.0 (by janobe) via the Category parameter in /category.php allows remote, unauthenticated attackers to manipulate backend database queries with no user interaction required. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation is straightforward and requires no privileges, though impact is limited (VC:L/VI:L/VA:L), indicating partial data exposure and manipulation rather than full system compromise. A publicly available proof-of-concept exists - reflected in the E:P threat modifier - yet the very low EPSS score of 0.03% (8th percentile) and absence from CISA KEV indicate no public exploit identified at time of analysis has driven widespread automated attacks.

Technical ContextAI

SourceCodester Point of Sales 1.0 is a PHP-based retail management application developed by janobe and distributed via SourceCodester (CPE: cpe:2.3:a:janobe:point_of_sales:1.0:*:*:*:*:*:*:*). The vulnerable file /category.php accepts a Category parameter and incorporates it into a SQL query without adequate sanitization or parameterization, a classic failure classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection). This root cause encompasses the broader injection family, where untrusted input is passed to an interpreter - in this case an SQL engine - allowing an attacker to alter query logic. The PHP tag in the intelligence confirms the server-side language, and the SQLi tag confirms the specific injection subtype rather than a secondary injection class.

RemediationAI

No vendor-released patch has been identified at time of analysis for SourceCodester Point of Sales 1.0. The definitive fix is to refactor /category.php to use PHP PDO or MySQLi prepared statements with parameterized queries for the Category parameter, which eliminates the injection surface entirely. As a compensating control, deploying a WAF rule to block SQL metacharacter sequences (e.g., single quotes, UNION, OR 1=1 patterns) in the Category parameter can reduce exploitation success but is bypassable and should not substitute for code-level remediation. If the application is internet-accessible and not required for active operations, taking it offline is the most effective risk reduction - particularly given its academic-use-case nature. Restricting the database user account to SELECT-only permissions on the minimum required tables limits data manipulation and deletion impact even if injection is achieved. See vulnerability details at https://vuldb.com/?id.329961 and the proof-of-concept reference at https://github.com/J-Fy2767/CVE/issues/4.