CodeAstro Simple Loan CVE-2026-104625

Exploitation targets the admin interface at /admin/index.php and requires a request manipulating the g_name argument; the CVSS vector's PR:L indicates a low-privilege authenticated session to the application is needed, which is the primary limiting factor. No user interaction is required (UI:N) and the vector is network-reachable (AV:N) with low complexity (AC:L), so once authenticated an attacker can exploit default installations of CodeAstro Simple Loan Management System 1.0. Real-world exposure is chiefly constrained by the product's rarity and by whether the admin panel is reachable from the attacker's network position rather than by any special non-default configuration.

This is a moderate, not critical, priority. The CVSS 4.0 base score of 5.3 (Medium) reflects a network-reachable SQL injection (AV:N/AC:L/AT:N) that nonetheless requires low-level privileges (PR:L) and yields only Low impact to confidentiality, integrity, and availability (VC:L/VI:L/VA:L) with no scope change. The /admin/index.php path and the g_name parameter indicate the injection sits behind the admin interface, consistent with PR:L - an authenticated (low-privilege) context rather than fully anonymous access. Publicly available exploit code exists (confirmed via a GitHub issue reference and the VulDB submission), and the input vector carries E:P (Proof-of-Concept), which raises practical risk versus a purely theoretical bug. However, there is NO EPSS score provided and NO CISA KEV listing, so there is no evidence of widespread or active exploitation - the signals indicate opportunistic/POC-driven risk, not confirmed in-the-wild campaigns. The dominant mitigating factor is prevalence: this is a small open-source CodeAstro PHP application with negligible enterprise footprint, which sharply limits real-world exposure despite the network attack vector. Net assessment: a real but low-urgency issue for the few organizations running this specific product; low priority for the general population.

An attacker with low-privilege access to the admin area of a Simple Loan Management System instance submits a crafted value in the g_name parameter to /admin/index.php, injecting SQL that the backend executes against the database. Because publicly available exploit code exists and attack complexity is low, a low-skilled attacker can reproduce the injection remotely to read or tamper with loan/customer records. The impact is bounded to Low across C/I/A, so partial data disclosure or modification is the realistic outcome rather than full database compromise.