SourceCodester Point of Sales CVE-2025-12294

The attacker must possess high-privilege credentials for the Point of Sales application (PR:H in CVSS vector). Exploitation cannot occur via unauthenticated network access - a valid administrator account is required. The /delete_category.php endpoint must be accessible to the authenticated user, which is expected in standard POS deployments where administrators manage product categories. The vulnerability is not dependent on non-default configuration; it affects default installations where the unpatched code exists.

This vulnerability presents a paradoxical risk profile. While the CVSS v4.0 vector indicates network accessibility (AV:N), the high privilege requirement (PR:H) and low impact ratings (VC:L/VI:L/VA:L) significantly constrain exploitability. The EPSS score of 0.03% (7th percentile) reflects this constraint - despite public exploit availability, real-world exploitation likelihood is minimal. The vulnerability is NOT actively exploited per CISA KEV standards; it is merely publicly disclosed with POC code. Attack complexity is low (AC:L) and no user interaction is required (UI:N), but the mandatory high-privilege attacker context (requiring administrative authentication) is the critical limiting factor. An insider threat or compromised admin account would be required to trigger the vulnerability. The low CVSS score (2.0) accurately reflects this - the technical impact is limited even if a high-privilege user is compromised. Real-world risk depends heavily on administrative credential hygiene and network isolation of the POS application.

An authenticated administrator with access to the POS system (or an attacker who has compromised administrative credentials through phishing or credential stuffing) navigates to or sends a crafted HTTP request to /delete_category.php with a malicious SQL payload in the ID parameter, such as ID=1 OR 1=1 or ID=1; DROP TABLE categories;--. The unvalidated parameter is incorporated into a SQL query, allowing the attacker to enumerate database contents, modify category records, or potentially escalate impact depending on database permissions and query context.