Simple Stock System
CVE-2025-14968
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP POST to /market/update.php with SQLi-loaded email parameter
-
ExploitInject malicious SQL logic into database query
-
ImpactExtract or modify data in the backend database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default deployments of Simple Stock System 1.0. The /market/update.php endpoint must be reachable over the network, which is typical for a web application. No user interaction or prior authentication is required. |
| Impact | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) yields a Medium severity score of 5.5, reflecting low-impact data disclosure and manipulation. However, EPSS is only 0.05% (15th percentile), indicating low likelihood of widespread exploitation. No KEV listing confirms absence of known in-the-wild attacks, though publicly available exploit code lowers the barrier for opportunistic use. The product's niche nature further reduces real-world urgency. Contrasting signals suggest this is a low-priority issue for most organizations unless the specific software is in use. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP POST request to the /market/update.php endpoint with a malicious email value containing SQL injection payloads. This could extract sensitive information from the database (e.g., user credentials) or alter stock records. The publicly available proof-of-concept simplifies exploitation for unauthenticated remote attackers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 26, 2026
Remote SQL injection in Simple Stock System 1.0 allows unauthenticated attackers to manipulate SQL queries via the email parameter in /market/update.php. Public exploit code exists, but no active exploitation has been confirmed. The vulnerability affects the code-projects.org stock management application, potentially exposing database contents.
RemediationAI
No vendor patch is available at the time of analysis. As an immediate workaround, apply input validation or implement parameterized queries in /market/update.php to sanitize the email parameter. If source modification is not feasible, consider restricting network access to the /market/ directory via a firewall or web server rule, or temporarily disabling the update functionality. Monitor the project's repository for future updates.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a SQL injection (CWE-74) located in the PHP file /market/update.php of the Simple Stock System web application. The application constructs a SQL query by directly incorporating unsanitized user input from the email parameter, typical of classic dynamic query vulnerabilities. The affected product (cpe:2.3:a:carmelo:simple_stock_system:1.0) is a lightweight inventory system written in PHP, likely relying on a MySQL/MariaDB backend.
Know when Simple Stock System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-accessible SQL injection with no authentication; limited impact on database confidentiality, integrity, and availability.
Primary rating from NVD.
CVSS VectorNVD
DescriptionCVE.org
A security flaw has been discovered in code-projects Simple Stock System 1.0. Affected by this issue is some unknown functionality of the file /market/update.php. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
More in Simple Stock System
View allCode-projects Simple Stock System 1.0 is vulnerable to SQL Injection. Rated critical severity (CVSS 9.8), this vulnerabi
SQL injection in Simple Stock System 1.0 allows remote attackers to manipulate the uname parameter in /logout.php, poten
SQL injection in Simple Stock System 1.0 allows unauthenticated remote attackers to manipulate database queries via the
SQL injection in Simple Stock System 1.0’s login page allows unauthenticated remote attackers to manipulate database que
Stored cross-site scripting (XSS) in Simple Stock System 1.0 via the /market/chatuser.php endpoint allows remote attacke
SQL injection in Simple Stock System 1.0 via the Username parameter in /checkuser.php allows authenticated remote attack
Exploit-DB