Society Management System CVE-2025-15354

The CVSS 4.0 vector (PR:N/UI:N/AV:N/AC:L) asserts this is exploitable remotely by unauthenticated attackers with no user interaction required. However, the affected file resides at /admin/add_admin.php, which is an administrative function - whether the application enforces a session authentication check before reaching the vulnerable SQL query is not confirmed by available data and represents the key unresolved condition. If the admin panel is publicly accessible without login (common in tutorial-grade PHP apps), exploitation requires only network reachability. What limits exploitation: the product is a niche hobbyist system with a very small internet-facing deployment footprint; the vulnerability is constrained to version 1.0 with no indication of widespread adoption. No specific non-default configuration is required beyond the application being deployed and the /admin/ path being accessible.

The vendor-assigned CVSS 4.0 score of 5.5 (Medium) with limited confidentiality, integrity, and availability impact (VC:L/VI:L/VA:L) reflects the constrained scope of this flaw against what is clearly a small-scale PHP application. EPSS at 0.04% (11th percentile) is very low, meaning statistical models predict minimal active exploitation probability compared to other CVEs - consistent with the product's obscure deployment footprint rather than any technical barrier to exploitation. A public POC exists (GitHub issue referenced in NVD), which contradicts the low EPSS signal and means exploitation requires no novel research. KEV status is negative, so no confirmed in-the-wild abuse has been reported to CISA. The CVSS PR:N metric asserts no authentication is required, which conflicts with the /admin/ path - this discrepancy is unresolved in available data and should be verified by defenders before assuming full unauthenticated exposure. Overall, this is a low-priority finding due to product obscurity, but trivially exploitable on any live instance.

An attacker identifies a publicly reachable instance of Society Management System 1.0, navigates to /admin/add_admin.php, and submits an HTTP POST or GET request with a crafted Username parameter containing a SQL injection payload (e.g., a UNION-based or blind boolean payload). Since a public POC is available on GitHub, the attacker can adapt it with minimal effort to extract database contents including credentials, user records, or society data.