Online Farm System CVE-2025-8332

The /register.php endpoint must be reachable over the network - this is a pre-authentication surface requiring no credentials (PR:N in the CVSS vector). The only prerequisite is that the Online Farm System 1.0 application is deployed and the registration page is accessible to the attacker. No special configuration, enabled feature, or non-default setting is required; the vulnerability exists in the default application state. Limiting factors include: the product's extremely narrow deployment footprint (primarily educational/demo use), the absence of known mass-exploitation tooling targeting this application, and the application's likely absence from internet-facing production environments. Exploitation is bounded to the specific PHP application and its configured database - no scope change to adjacent systems is indicated.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/E:P) scores 5.5 (Medium) and reflects a fully unauthenticated network-reachable attack with partial confidentiality, integrity, and availability impact on the vulnerable system and no downstream scope change. The exploitation threat modifier E:P confirms a publicly available proof-of-concept, which is consistent with the GitHub issue reference. The EPSS score of 0.07% at the 20th percentile is notably low, strongly suggesting that despite the trivial exploit technique and public PoC, widespread opportunistic exploitation is not occurring - most likely because the product has a very small real-world deployment base as a demo/educational application. The vulnerability is not listed in CISA KEV, further supporting the conclusion that this is not being exploited at scale. Real-world priority should therefore be LOW for most organizations, with elevated concern only for any institution that has actually deployed this application in a production environment.

An unauthenticated remote attacker sends an HTTP POST request to /register.php with a crafted Username value such as ' OR 1=1-- or a UNION-based payload to enumerate database tables and extract credentials or other stored data. Because a public proof-of-concept exists at the referenced GitHub issue, the attack technique is documented and reproducible by low-skilled attackers. No interaction from an authenticated user or administrator is required.