Ingredients Stock Management System CVE-2026-10235

Exploitation requires a valid low-privilege user account on the CodeAstro Ingredients Stock Management System - confirmed by the CVSS PR:L designation. The attacker must be able to reach and interact with the /Ingredients-Stock/stock_manager.php endpoint and submit input to the txt_search_category parameter, which is the specific injectable field identified. No non-default configuration or special deployment mode is required beyond authenticated access to the stock manager feature. Exploitation is bounded by the authentication gate: unauthenticated external attackers cannot exploit this directly without first acquiring credentials through phishing, credential stuffing, or another vector. The unchanged scope (S:U) means exploitation impact is confined to the application's database context and does not automatically pivot to the underlying host OS.

The CVSS 6.3 Medium score reflects a balanced signal set: AV:N (network-exploitable), AC:L (no special conditions beyond authentication), PR:L (requires any valid low-privilege account), UI:N (no victim interaction), with partial confidentiality, integrity, and availability impact (C:L/I:L/A:L) and unchanged scope (S:U). The temporal modifiers reinforce caution - E:P confirms a proof-of-concept exists, RL:X indicates no known remediation level, and RC:R indicates reasonable but not fully confirmed reporting. No EPSS score was provided in the source data, preventing quantitative exploitation probability comparison. The absence of a CISA KEV listing means active in-the-wild exploitation is not confirmed, but the public PoC on GitHub (https://github.com/Pluto2362/CVE/issues/1) closes the skill gap considerably. Real-world priority is moderate: the authentication requirement (PR:L) meaningfully reduces the attack surface compared to unauthenticated SQLi, but any deployment allowing self-registration or with shared/stolen credentials should treat this as high priority. The unchanged scope limits blast radius to the application database context.

An attacker who has obtained or registered a low-privilege account on the Ingredients Stock Management System navigates to the stock manager search interface and submits a crafted SQL payload (e.g., a UNION-based or error-based injection string) in the category search field. The unsanitized input is passed directly into a backend SQL query, allowing the attacker to enumerate database tables, extract credential hashes or other sensitive records, or modify inventory data. A public proof-of-concept demonstrating this technique is available at https://github.com/Pluto2362/CVE/issues/1, meaning exploitation requires minimal SQL injection knowledge.