Online Farm System CVE-2025-8331

Exploitation requires that a publicly network-accessible instance of Online Farm System 1.0 exist - specifically, the /forgot_pass.php endpoint must be reachable. No authentication is required; the forgot-password form is designed to be publicly accessible. No special configuration, non-default settings, or user interaction is needed beyond the ability to send an HTTP POST request with a crafted email parameter. The CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) confirms this: no privileges, no user interaction, low complexity, and no attack requirements. Exploitation is bounded to installations of Online Farm System 1.0 specifically - other versions are not confirmed affected. Impact is further limited by the low-rated VC:L/VI:L/VA:L metrics, meaning database access is partial rather than full administrative compromise. The primary limiting factor in practice is the extreme rarity of this application in real-world deployments.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a worst-case accessibility profile: network-reachable, low complexity, no authentication, no user interaction, and no special attack requirements - all factors that in a widely deployed product would demand immediate response. However, impact metrics are constrained (VC:L/VI:L/VA:L/SC:N/SI:N/SA:N), indicating the blast radius is limited to partial read/write/disruption of the application's own database rather than full system compromise or lateral movement. The E:P modifier in the supplied vector confirms a publicly available exploit, which is an independent urgency signal. Counterbalancing this, the EPSS score of 0.07% at the 20th percentile indicates very low observed or predicted exploitation activity - a signal consistent with an obscure, niche product with minimal internet exposure. There is no CISA KEV entry. The realistic priority for most organizations is very low given the product's rare deployment footprint, but any organization publicly hosting this specific application should treat remediation as urgent given the unauthenticated entry point and available PoC.

An unauthenticated attacker identifies a publicly hosted Online Farm System 1.0 instance, navigates to /forgot_pass.php, and submits a crafted email value containing SQL injection syntax (e.g., a boolean-based or UNION-based payload). The unsanitized input is interpolated directly into a database query, allowing the attacker to enumerate table structures, extract user credentials or personal data, or potentially modify records. A public PoC demonstrating this technique is available at https://github.com/wllovemy/cve/issues/10, meaning exploitation requires minimal SQL injection knowledge.