Online Farm System
CVE-2025-8331
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-accessible forgot-password endpoint with no interaction needed; impact limited to partial database read/write, no scope change to other systems.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in code-projects Online Farm System 1.0 and classified as critical. This issue affects some unknown processing of the file /forgot_pass.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
SQL injection in Online Farm System 1.0 exposes the unauthenticated password-reset endpoint /forgot_pass.php to remote attackers who can manipulate the email parameter to inject arbitrary SQL commands against the backend database. A public exploit PoC was disclosed on GitHub (https://github.com/wllovemy/cve/issues/10) at time of reporting, lowering the technical barrier for exploitation. Despite the straightforward, unauthenticated attack surface, EPSS is very low at 0.07% (20th percentile), consistent with the product's minimal real-world deployment footprint and niche audience; no CISA KEV listing exists.
Technical ContextAI
Online Farm System 1.0 is a PHP-based agricultural management web application distributed by code-projects (CPE: cpe:2.3:a:anisha:online_farm_system:1.0:*:*:*:*:*:*:*). The root cause is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), with the specific manifestation being unsanitized user-supplied input passed directly into SQL query construction within the /forgot_pass.php password-reset handler. The email field is concatenated into a database query without parameterization or escaping, a classic absence-of-prepared-statements defect in PHP applications that interact with relational databases. Because the forgot-password page is publicly accessible by design, no authentication bypass step is necessary.
RemediationAI
No vendor-released patch has been identified at time of analysis; Online Farm System 1.0 is a code-projects demo application for which formal patching is unlikely without direct source modification. The primary recommended fix is to rewrite the affected SQL query in /forgot_pass.php to use parameterized queries or prepared statements (e.g., PHP PDO or MySQLi with bound parameters), which eliminates the injection vector at the root cause. As an immediate compensating control, restrict access to /forgot_pass.php via web server configuration (Apache .htaccess or nginx location block) to trusted IP ranges or disable the endpoint entirely if password recovery is not in use - note this disables the forgot-password feature for all users. Deploying a WAF rule targeting SQL metacharacters in the email POST parameter provides a secondary, defense-in-depth layer but should not be treated as a substitute for code-level remediation. If the application has no legitimate public user base, removing it from internet-facing infrastructure eliminates all exposure. See the VulDB advisory at https://vuldb.com/?id.318281 and exploit PoC at https://github.com/wllovemy/cve/issues/10 for technical details.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today