PHP CVE-2025-6489

This vulnerability presents substantial real-world risk corroborated by multiple indicators: (1) CVSS 7.3 reflects High severity with network accessibility, low attack complexity, and no privilege requirement—attackers can exploit from the internet without authentication; (2) The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L indicates complete lack of barriers to exploitation; (3) Public disclosure combined with SQL injection's inherent automatable nature significantly elevates exploitation probability; (4) SQL injection vulnerabilities in e-commerce systems directly impact financial data, customer PII, and business continuity. The vulnerability is not a theoretical high-CVSS-but-low-risk issue—it represents genuine, immediately exploitable danger. Organizations running Agri-Trading 1.0 should treat this as a critical priority, particularly given the public availability of exploitation techniques and the trivial nature of SQL injection attacks to automate at scale.

An attacker discovers an Agri-Trading Online Shopping System 1.0 instance via public-facing deployment. They craft a malicious HTTP request to /transactionsave.php?del=1'+UNION+SELECT+user(),database(),version()--+ to extract database credentials and version information. Using this reconnaissance, they execute: /transactionsave.php?del=1';DROP+TABLE+users;-- to delete the user table, causing denial of service. Alternatively, they inject: /transactionsave.php?del=1'+UNION+SELECT+email,password,credit_card_data+FROM+customers-- to exfiltrate customer data. The attack requires only a web browser or curl, zero authentication, and takes minutes to execute. No user interaction is needed—direct HTTP GET/POST requests trigger the vulnerability. Given public disclosure, automated scanners and exploit frameworks likely already include payloads for this CVE.