Prison Management System CVE-2025-14589

Exploitation requires valid authenticated access to the Prison Management System administrative interface (PR:L in CVSS vector). An attacker must already possess valid login credentials for an administrative account. The vulnerability is exploitable over the network (AV:N) and does not require user interaction (UI:N), but the authentication barrier is a mandatory prerequisite - unauthenticated remote attackers cannot exploit this flaw. Non-default configuration is not a limiting factor; the vulnerability exists in default /admin/search.php functionality. Exploitation is limited to confidentiality impact; SQL injection does not enable data modification or deletion due to the restricted scope (SC:N/SI:N/SA:N).

This vulnerability presents LOW real-world risk despite public exploit availability. Multiple risk signals are misaligned: CVSS 2.1 is extremely low, reflecting the authentication requirement (PR:L) and limited impact scope (only confidentiality affected: VC:L/VI:L/VA:L, with integrity and availability unaffected). EPSS score of 0.05% (15th percentile) confirms minimal exploitation probability, suggesting targeted attacks against specific deployments rather than mass exploitation. The combination of authenticated access requirement, low CVSS score, and very low EPSS percentile indicates this is NOT a critical priority for most defenders, despite public POC availability. However, organizations running Prison Management System 2.0 should still assess whether admin account compromise is realistic in their threat model - if administrative credentials are weak or widely shared, this becomes a higher priority for that specific environment. The limited impact (read-only access to data via SQL injection, no code execution or data modification) further reduces risk severity.

An authenticated administrator or attacker with stolen admin credentials accesses the Prison Management System administrative panel. They navigate to /admin/search.php and inject malicious SQL syntax into the keyname parameter (e.g., keyname=admin' OR '1'='1), which bypasses query logic and returns unauthorized database records containing sensitive inmate or staff information. The attacker exfiltrates confidential data without triggering integrity or availability alerts.