Modern Bag CVE-2025-7461

The risk profile is HIGH for exposed instances: CVSS 7.3 reflects network accessibility (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), and no user interaction (UI:N), meaning any network-accessible Modern Bag 1.0 installation is immediately vulnerable. The public disclosure of exploit code (POC available) significantly increases exploitation likelihood and probability. The vulnerability impacts confidentiality, integrity, and availability equally (C:L/I:L/A:L), suggesting attackers can read data, modify records, or potentially disrupt application function. However, without EPSS data or KEV confirmation status, real-world exploitation probability cannot be definitively quantified; nevertheless, SQL injection combined with public POC availability should be treated as high-priority. Organizations running Modern Bag 1.0 in production should treat this as requiring immediate remediation due to the combination of ease-of-exploitation, public tooling, and complete lack of authentication barriers.

An attacker discovers a publicly accessible Modern Bag 1.0 installation and identifies the /action.php endpoint. Without authentication, the attacker crafts a malicious HTTP request to /action.php with proId parameter containing SQL injection payload, such as: proId=1' OR '1'='1 or proId=1; DROP TABLE products;--. The unvalidated input is concatenated into a SQL query, causing the database to execute the attacker's injected SQL command. In a low-complexity exploitation scenario, the attacker could extract product data, user credentials, or other sensitive information from the database, or modify product records to disrupt business operations. With public POC code available, this attack requires only basic HTTP tools (curl, Burp Suite, or custom scripts) and can be automated for mass scanning and exploitation across multiple vulnerable instances.