Inventory Management System CVE-2025-6501

The CVSS 3.1 score of 7.3 reflects HIGH severity with these key characteristics: Network-accessible (AV:N) with no authentication required (PR:N), no user interaction needed (UI:N), and low attack complexity (AC:L), resulting in broad exploitability. The impact is 'Low' across confidentiality, integrity, and availability (C:L/I:L/A:L), indicating the vulnerability grants query-level access rather than system-level compromise. However, multiple risk amplification factors elevate real-world danger: (1) Public exploit disclosure and PoC availability eliminate exploitation barriers, (2) SQL injection typically enables privilege escalation and lateral movement beyond the stated 'Low' impact rating, (3) typical IMS systems handle sensitive inventory, financial, and user data where even 'partial' access creates compliance violations (PCI-DSS, HIPAA, GDPR). The actual exploitability probability (EPSS) is likely elevated due to accessibility and automation potential. This is NOT a case of high-CVSS-but-low-risk; instead, CVSS underrates the true impact because SQL injection in web applications frequently permits data exfiltration, authentication bypass, and system compromise beyond the base metrics. KEV status (known exploit in the wild) combined with public PoC transforms this into an immediate prioritization target. SSVC decision framework rates this as Exploitation=Active/Accessible, Automatable=Yes (SQL injection tools widely available), Technical Impact=Integrity (with potential for Confidentiality loss), placing it in the 'Act Now' category.

An unauthenticated attacker identifies the inventory management system via port scanning or search engines (Shodan, etc.). They craft a malicious HTTP request to POST /php_action/createCategories.php with a payload like: categoriesStatus=active' OR '1'='1' UNION SELECT user(),database(),version()-- . The vulnerable PHP code concatenates this directly into a SQL query without escaping or parameterization, executing: SELECT * FROM categories WHERE status='active' OR '1'='1' UNION SELECT user(),database(),version()--'. The attacker receives the database user, name, and version in the response. In a follow-up request, they use a time-based blind SQL injection or UNION-based technique to exfiltrate the entire user table containing credentials, product listings, and pricing data. If the database user has FILE privileges, the attacker could read /etc/passwd or write a web shell to disk. Because the application runs in a PHP environment and likely uses shared hosting or inadequately sandboxed servers, the attacker may escalate to remote code execution (RCE) via INTO OUTFILE or via PHP filter chains. Public PoC tools (e.g., sqlmap) fully automate this attack, requiring only the URL and parameter name—reducing exploitation time to minutes.