EUVD-2025-20688Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to /admin/suppliercontroller.php with malicious supplier parameter
-
ExploitSQL injection executes arbitrary database commands
-
ImpactRetrieve sensitive data from the database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default installations of Agri-Trading Online Shopping System 1.0. The /admin/suppliercontroller.php endpoint is accessible without authentication despite its location inside an 'admin' directory, allowing any network attacker to trigger the injection. No user interaction or administrative configuration is required. The attack is constrained only by the low impact of SQL injection on the database (no file system access or remote code execution). |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N) indicates a network-accessible, low-complexity attack with no privileges required, but the impact on the vulnerable system is only low across confidentiality, integrity, and availability, with no subsequent system impact. EPSS predicts a 0.05% probability of exploitation (14th percentile), suggesting low likelihood of widespread attacks. The exploit is publicly disclosed on GitHub, yet the absence of a KEV listing confirms no active exploitation. While SQL injection can lead to data exfiltration, the limited impact metrics and low EPSS make this a moderate real-world risk, not a critical priority. The low CVSS score (5.5) accurately reflects the limited damage potential. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP request (GET or POST) to the target's /admin/suppliercontroller.php, injecting malicious SQL into the 'supplier' parameter. The injected payload causes the database to execute arbitrary queries, allowing the attacker to extract sensitive data such as user credentials or financial records. A public proof-of-concept exploit is published, enabling widespread replication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
SQL injection in itsourcecode Agri-Trading Online Shopping System 1.0 allows remote, unauthenticated attackers to execute arbitrary SQL commands via the 'supplier' parameter in /admin/suppliercontroller.php. Exploit code is publicly available, but no evidence of active exploitation. The vulnerability carries a CVSS 4.0 base score of 5.5 (Medium) with limited impact on confidentiality, integrity, and availability.
RemediationAI
No vendor-released patch has been identified at the time of this analysis. The open-source nature of the project suggests that community updates may emerge. As immediate compensating controls, consider disabling or restricting access to /admin/suppliercontroller.php if not essential-this may break admin supplier-management functionality. Deploying a Web Application Firewall (WAF) rule to block SQL injection attempts on the 'supplier' parameter can mitigate attacks with minimal false positives. For a code-level fix, developers should implement parameterized queries or rigorous input validation for the 'supplier' parameter, but note that such changes require re-deployment of the application. Monitor the VulDB entry and GitHub issue for any official patches.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw exists in a PHP file /admin/suppliercontroller.php that fails to properly sanitize user-supplied input before constructing SQL queries. The underlying technology is a custom PHP e-commerce platform; the root cause aligns with CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), a parent class of SQL injection. According to CPE cpe:2.3:a:adonesevangelista:agri-trading_online_shopping_system:*:*:*:*:*:*:*:*, all versions up to and including 1.0 are affected, with the vulnerability residing in an unspecified function that handles the 'supplier' parameter directly in database calls.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote unauthenticated attack with no user interaction and limited impact on confidentiality, integrity, and availability.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in itsourcecode Agri-Trading Online Shopping System up to 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/suppliercontroller.php. The manipulation of the argument supplier leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB