EUVD-2025-16853
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4DescriptionNVD
A vulnerability classified as critical has been found in PHPGurukul Dairy Farm Shop Management System 1.3. This affects an unknown part of the file /add-company.php. The manipulation of the argument companyname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
Critical SQL injection vulnerability in PHPGurukul Dairy Farm Shop Management System version 1.3, specifically in the /add-company.php file where the 'companyname' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to data theft, modification, or deletion. The exploit has been publicly disclosed and proof-of-concept code is available, significantly increasing real-world exploitation risk.
Technical ContextAI
This vulnerability exploits improper input validation in PHP web applications, classified under CWE-74 (Improper Neutralization of Special Elements in Output, 'Injection'). The /add-company.php endpoint accepts user-supplied input (companyname parameter) and passes it directly into SQL queries without parameterized queries or prepared statements. PHPGurukul Dairy Farm Shop Management System 1.3 is a PHP-based e-commerce management application (CPE: cpe:2.3:a:phpgurukul:dairy_farm_shop_management_system:1.3:*:*:*:*:*:*:*) that manages inventory and transactions. The root cause is the absence of input validation and the use of string concatenation for SQL query construction rather than parameterized queries or ORM frameworks that automatically escape user input.
Share
External POC / Exploit Code
Leaving vuln.today