Best Salon Management System CVE-2025-12325

The /panel/forgot-password.php endpoint is publicly accessible without authentication, as it serves the password reset form prior to any login - no session, token, or credentials are required. The CVSS 4.0 vector confirms PR:N (no privileges) and UI:N (no victim interaction needed). The only prerequisite is network-level reachability to the web server hosting the application. Exploitation is bounded by the niche footprint of the product itself and by the likely restricted database permissions of the application account (reflected in VC:L/VI:L/VA:L impact metrics). No non-default configuration or special feature enablement is required - the vulnerable parameter exists in the default installation.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) presents the worst-case access profile: network-reachable, no complexity barriers, no privileges, no user interaction required. However, the overall score of 5.5 (Medium) is tempered by limited impact metrics (VC:L/VI:L/VA:L), suggesting the database account under which the application runs has constrained permissions - consistent with typical shared-hosting PHP deployments. EPSS at 0.03% (8th percentile) indicates very low exploitation probability despite POC availability, likely due to the niche deployment footprint of this product. The vulnerability is not listed in CISA KEV, confirming no observed mass exploitation. This is a genuine but low-urgency finding - real risk is primarily confined to organizations actively running this specific application in production. One important caveat: the exploit reference URL points to a report for a 'Best house rental management system' rather than the salon management system, introducing uncertainty about the POC's direct applicability.

An unauthenticated attacker submits an HTTP POST request to /panel/forgot-password.php with a crafted email value such as ' OR '1'='1' --, causing the backend SQL query to return all user records or bypass conditional logic. With a public proof-of-concept available, even low-skill attackers can adapt the technique to enumerate database contents, extract password hashes, or insert rogue records depending on the database account's permissions.