Simple Stock System CVE-2025-14834

Authentication is required - attacker must possess valid login credentials to access the application and reach the /checkuser.php endpoint. The Username parameter in /checkuser.php must be processed directly in SQL queries without parameterization or input filtering. The attack is limited to authenticated users and does not yield high-impact outcomes (VC:L/VI:L/VA:L per CVSS vector), restricting ability to compromise confidentiality, integrity, or availability at scale. No special non-default configuration or specific deployment mode is documented as required; standard deployment of Simple Stock System 1.0 is vulnerable if login is enabled.

Multiple signals indicate low real-world risk despite public exploit availability. CVSS 4.0 score of 2.1 is extremely low, reflecting the PR:L (authenticated) requirement and minimal impact ratings (VC:L/VI:L/VA:L). EPSS exploitation probability of 0.05% (15th percentile) strongly suggests this vulnerability is unlikely to be exploited at scale, despite POC availability. The CVSS vector shows E:P (exploit proof-of-concept exists), confirming public exploit code but not active widespread exploitation. Attack vector is AV:N (network), so remote access is possible, but the authentication gate and minimal impact combine to create a low-priority vulnerability. Organizations with strict access controls limiting who can reach /checkuser.php face further reduced risk. This is a classic example of a high-CVSS-value metric (network) paired with realistic constraints (login required) that deflate actual threat level.

An authenticated user with login credentials to Simple Stock System 1.0 navigates to /checkuser.php and submits a crafted Username parameter such as 'admin' OR '1'='1' or a UNION-based query to extract user data or bypass queries. Because the application does not sanitize this input, the malicious SQL is executed directly against the backend database, allowing the attacker to read unauthorized data or modify database records without administrative privileges.