Society Management System CVE-2025-15353

The vulnerability is triggered by sending a crafted value in the Username parameter to the edit_admin_query function at /admin/edit_admin_query.php. The primary limiting factor is access to the admin panel: the /admin/ path strongly implies that an authenticated administrator session is required, meaning an attacker must first obtain valid admin credentials or exploit a separate authentication bypass. If the admin directory is misconfigured as publicly accessible (no authentication enforced at the web server or application layer), exploitation would require no credentials. No special protocol, plugin, or non-default feature configuration is needed beyond basic HTTP access to the endpoint. The attack is limited to Society Management System version 1.0 only; no other versions are confirmed affected.

The reported CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) designates this as a remotely exploitable, zero-complexity, unauthenticated attack, but this assessment deserves scrutiny: the vulnerable endpoint resides under the /admin/ path, which in virtually all PHP CMS-style applications implies an authenticated session. The CVSS PR:N designation is likely assigned by VulDB (cna@vuldb.com) conservatively assuming the admin panel may be publicly reachable, but the actual exploitation condition probably requires at least session-level admin authentication - a significant limiter. EPSS of 0.04% at the 11th percentile signals extremely low in-the-wild exploitation probability despite a public PoC. KEV status is absent, confirming no CISA-tracked active exploitation. The impact metrics (VC:L/VI:L/VA:L) appear understated for a SQL injection class - unconstrained SQLi typically yields full database read/write. Overall, real-world risk is moderate-to-low: the product is niche with minimal enterprise footprint, no patch exists (raising residual risk for active deployments), and the PoC lowers attacker effort. Priority only for organizations actively running this specific application version.

An attacker with access to the admin panel session (or, per the CVSS PR:N claim, potentially without authentication if the /admin/ directory is publicly reachable) navigates to /admin/edit_admin_query.php and submits a crafted HTTP POST or GET request with a malicious SQL payload in the Username parameter, such as ' OR 1=1-- or UNION SELECT-based strings. The public PoC at the referenced GitHub issue demonstrates a working payload. Successful exploitation enables the attacker to enumerate and exfiltrate all database tables, including user credentials, or modify admin records to escalate privileges.