EUVD-2025-18855CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability has been found in itsourcecode Agri-Trading Online Shopping System 1.0 and classified as critical. This vulnerability affects unknown code of the file /transactionsave.php. The manipulation of the argument del leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-6489 is a critical SQL injection vulnerability in itsourcecode Agri-Trading Online Shopping System version 1.0, affecting the /transactionsave.php file through the 'del' parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially compromising confidentiality, integrity, and availability of the application database. Public disclosure of this vulnerability exists, and exploitation is feasible without authentication or user interaction.
Technical Context
This vulnerability represents a classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements used in an SQL Command) in a PHP-based e-commerce application. The /transactionsave.php endpoint fails to properly sanitize or parameterize the 'del' parameter before incorporating it into SQL queries. The affected product, itsourcecode Agri-Trading Online Shopping System 1.0, is built on PHP and likely uses either MySQLi or MySQL extensions without prepared statements. CWE-74 specifically addresses cases where user-supplied data is concatenated directly into SQL queries without proper escaping or parameterized query techniques. The attack surface includes any web-accessible endpoint that processes transaction data deletion requests, commonly found in e-commerce platforms handling order management and transaction history.
Affected Products
Agri-Trading Online Shopping System (['1.0'])
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today