SourceCodester Point of Sales CVE-2025-12293

The injection point is the Category parameter submitted to /category.php, and no authentication, special configuration, or user interaction is required - confirmed by the CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N). Remote unauthenticated exploitation is possible against any internet-accessible deployment of SourceCodester Point of Sales 1.0 in its default configuration. Exploitation is bounded by actual deployment of this specific PHP application; the software is primarily distributed as an academic or student project via SourceCodester, significantly limiting real-world exposure. No non-default feature flag or configuration setting is cited as a precondition in the CVE description or references.

The CVSS 4.0 base score of 5.5 is internally consistent with an AV:N/AC:L/AT:N/PR:N/UI:N vector paired with limited system impact (VC:L/VI:L/VA:L) and no subsequent-system impact (SC:N/SI:N/SA:N). The E:P threat modifier confirms a proof-of-concept is publicly available, which modestly elevates practical risk above the base score. However, the EPSS score of 0.03% at the 8th percentile is notably low and signals that mass automated exploitation has not been observed, likely because SourceCodester Point of Sales is primarily an academic or student demo application with minimal production deployment. The absence from CISA KEV further supports this interpretation. The realistic priority is low for most organizations; it becomes relevant only for any environment that has inadvertently deployed this application on an internet-accessible server. There is no CVSS vector conflict requiring escalation - description, CVSS, and EPSS are mutually consistent in characterizing a real but narrowly impactful vulnerability.

An unauthenticated remote attacker sends an HTTP request to /category.php with a crafted value in the Category parameter - for example, appending a SQL fragment such as ' OR '1'='1 or a UNION-based payload - causing the backend SQL query to return unintended data or execute attacker-controlled logic. A public proof-of-concept is documented in the GitHub issue at https://github.com/J-Fy2767/CVE/issues/4, lowering the technical barrier to exploitation. Depending on database permissions, the attacker may enumerate tables, extract credentials or transaction records, or manipulate data.