Online Farm System
CVE-2025-8332
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Registration endpoint is unauthenticated and network-reachable; SQL injection yields partial data read/write but no scope change or demonstrated availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in code-projects Online Farm System 1.0. It has been classified as critical. Affected is an unknown function of the file /register.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
SQL injection in code-projects Online Farm System 1.0 allows unauthenticated remote attackers to manipulate backend database queries by supplying crafted input to the Username parameter of the /register.php registration endpoint. The vulnerability is confirmed as critical by the reporter and a public proof-of-concept exploit is documented in a GitHub issue. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.07% (20th percentile) reflects the product's niche footprint despite the low technical barrier to exploitation.
Technical ContextAI
The affected product is a PHP-based web application identified by CPE cpe:2.3:a:anisha:online_farm_system:1.0:*:*:*:*:*:*:* distributed by code-projects.org, a repository of educational and demo PHP projects. The vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output), which in this context manifests as SQL injection: user-supplied input in the Username registration field is concatenated into a backend SQL query without sanitization or use of parameterized statements. This is a classic first-order injection pattern common in PHP applications that use mysqli or PDO without prepared statements. Because the vulnerable endpoint is /register.php - a pre-authentication surface - the attack requires no prior credentials.
RemediationAI
No vendor-released patch has been identified at time of analysis. The canonical fix requires refactoring /register.php to use parameterized queries (prepared statements) with either MySQLi or PDO, replacing any direct string concatenation of user input into SQL statements. As immediate compensating controls: restrict public access to the registration endpoint if open registration is not required by the deployment use case; deploy a web application firewall rule to block common SQL metacharacters (single quotes, comment sequences, UNION keywords) in the Username field, noting that WAF rules are bypassable and not a permanent solution; and enforce database least-privilege so the web application's database user cannot access sensitive tables beyond those required for application function. If the application is deployed for demo or educational purposes only, the strongest control is removal from public-facing infrastructure entirely.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today