Online Farm System CVE-2025-8333

No authentication is required - the CVSS 4.0 vector confirms PR:N (no privileges required) and AV:N (network accessible), meaning the /categoryvalue.php endpoint is reachable by any remote user without credentials. No special configuration is required beyond a standard installation of Online Farm System 1.0 with the PHP application exposed on a web server. The primary limiting factor is deployment prevalence: the product is a niche PHP demo application, and instances exposed to the internet are extremely rare. Exploitation is bounded to deployments where the application is internet-facing or reachable from an attacker's network position; installations behind strict network controls or not deployed at all are unaffected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) reflects a low-complexity, unauthenticated, network-exploitable flaw with limited confidentiality, integrity, and availability impact on the vulnerable system and no downstream scope change. The E:P modifier (proof-of-concept exists) is consistent with the referenced GitHub PoC. Despite these exploitation-friendly conditions, EPSS sits at 0.07% (20th percentile), indicating the security community observes minimal real-world exploitation interest - a direct consequence of the product's niche footprint rather than any technical barrier to exploitation. The vulnerability is not listed in CISA KEV. Signals are coherent: technically exploitable with low friction, but the attack surface in production environments is negligibly small. Organizations running this specific application in internet-exposed configurations should treat this as a genuine priority; all others face effectively zero exposure.

An unauthenticated attacker sends a crafted HTTP request to /categoryvalue.php with a SQL payload in the Value parameter (e.g., Value=1' UNION SELECT username,password,3 FROM users--) against a publicly accessible Online Farm System 1.0 instance. A public proof-of-concept demonstrating this technique is available at https://github.com/wllovemy/cve/issues/8. Successful exploitation enables the attacker to enumerate database tables and extract credentials or other sensitive application data stored in the backend.