Sales And Inventory System CVE-2025-7538

The CVSS 3.1 score of 7.3 reflects a HIGH severity vulnerability with important risk signals: (1) Network-based attack vector (AV:N) with low complexity (AC:L) and no privilege requirements (PR:N), indicating trivial exploitation; (2) No user interaction required (UI:N), enabling automated attacks; (3) Confidentiality, Integrity, and Availability all impacted (C:L/I:L/A:L), suggesting potential RCE or system compromise. The public disclosure of exploit code and stated active exploitation status escalates real-world risk significantly. Without EPSS data provided, the combination of unauthenticated network access, public POC availability, and unrestricted file upload (a high-impact primitive enabling RCE) suggests this represents a CRITICAL real-world priority despite the 7.3 CVSS score. This is not a low-risk high-score issue—it directly enables system takeover. Organizations running version 1.0 should treat this as actively exploited in the wild.

An unauthenticated attacker sends a POST request to the vulnerable /pages/product_update.php endpoint with a malicious PHP web shell embedded in the image parameter (e.g., renamed as image.jpg but containing PHP code). The application fails to validate the file type or content, stores the file in a web-accessible directory (e.g., /uploads/), and the attacker accesses the uploaded file via HTTP, triggering PHP execution. The attacker gains arbitrary code execution on the server with the privileges of the web server process, enabling complete system compromise: theft of the sales/inventory database, customer data exfiltration, inventory manipulation, or lateral movement within the internal network. No user interaction or privileged access is required, making this exploitable at scale against all exposed instances of version 1.0. Given public POC availability, automated scanning and exploitation tools are likely already deployed against this vulnerability.