haxxorsid Stock-Management-System CVE-2025-14568

Q: What is the CVSS score of CVE-2025-14568?

CVE-2025-14568 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-12 cna@vuldb.com

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:45 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0. This impacts an unknown function of the file model/User.php. The manipulation of the argument employee_id/id/admin leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

SQL injection in haxxorsid Stock-Management-System up to commit fbbbf213e9c93b87183a3891f77e3cc7095f22b0 allows authenticated remote attackers to execute arbitrary SQL queries via manipulation of the employee_id, id, or admin parameters in model/User.php. The vulnerability has a low CVSS score (2.1) due to limited scope and impact, but carries low but non-zero exploitation probability (EPSS 0.05%). Public exploit code exists and the product is no longer maintained, eliminating vendor-supplied patch availability.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-74: Improper Neutralization of Special Elements used in an SQL Command) in a PHP-based inventory management application. The vulnerable code in model/User.php fails to properly sanitize or parameterize SQL queries when processing the employee_id, id, and admin parameters. PHP applications using string concatenation or unfiltered input in database queries without prepared statements are susceptible to this attack class. The attack surface is limited to authenticated users, as indicated by the CVSS PR:L (requires low privilege) designation, suggesting the injection occurs in functionality accessible only after login.

Affected ProductsAI

haxxorsid Stock-Management-System affected through commit fbbbf213e9c93b87183a3891f77e3cc7095f22b0. The product uses continuous delivery with rolling releases, so specific version numbers are not available from vendor or NVD. All instances deployed prior to the unfixed commit are vulnerable. No CPE string provided in available data. Product details available at https://vuldb.com/?id.336192 and https://github.com/ixpqxi/CVE_LIST/blob/master/stock_management_system/sql_injection_vulnerability.md.

RemediationAI

No vendor-released patch is available, as the maintainer has ceased support for this product and did not respond to early disclosure. Organizations using this system should upgrade to a maintained alternative stock management solution immediately. If continued use is unavoidable, implement strict input validation and prepared statements (parameterized queries) in model/User.php for the employee_id, id, and admin parameters - replace all string concatenation in SQL queries with parameterized queries using PHP PDO or mysqli prepared statements. Additionally, restrict database access to a low-privilege account that cannot execute administrative SQL commands (e.g., DROP, ALTER), limiting attacker scope if injection succeeds. Monitor database query logs for suspicious SQL patterns. Apply principle of least privilege to application user accounts to reduce risk of credential compromise that would enable exploitation.