Inventory Management System CVE-2025-6828

No authentication is required (PR:N confirmed by CVSS 4.0 vector). The only prerequisite is HTTP network access to the /orders.php endpoint of a deployed Inventory Management System 1.0 instance. No special configuration, feature flag, or privileged role is needed. Exploitation is limited by the relative obscurity and low deployment footprint of the product - this is not a widely deployed enterprise platform. The application must be publicly or network-accessible; air-gapped or internally-isolated deployments are not reachable remotely.

Despite a CVSS 4.0 score of only 5.5, the real-world risk of this vulnerability is moderate to elevated for any organization actively running this software. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the attack requires no authentication, no special conditions, and is trivially reachable over the network - a meaningful gap from the low impact metrics (VC:L/VI:L/VA:L) assigned by the reporter, which likely understate the actual database exposure. SQL injection against order management endpoints typically grants read and write access to all database tables, not merely low-impact partial access. The EPSS score of 0.06% at the 18th percentile indicates very low observed exploitation probability in practice, consistent with this being a niche, low-footprint product, but the existence of a public POC means even a mid-sized municipal IT team in boleslawiec running this software should treat remediation as non-optional. No active exploitation is confirmed (not in CISA KEV), and the overall threat remains opportunistic rather than targeted. The CWE-74 classification is the parent injection class; the specific vulnerability is classic SQL injection (CWE-89) as confirmed by the SQLi tag and description.

An unauthenticated attacker sends a crafted HTTP request to /orders.php with a SQL injection payload in the i parameter (e.g., appending ' OR 1=1-- or a UNION-based query). Because the parameter is unsanitized, the database executes the attacker-controlled query, returning all order records or allowing data modification. A public proof-of-concept exists on GitHub, making this trivially reproducible.