Inventory Management System EUVD-2025-18844

While the CVSS 3.1 score of 7.3 indicates high severity, the contextual risk signals suggest critical priority: (1) Attack Vector is Network with Low Complexity and No Privileges Required—maximizing exploitability; (2) Public disclosure with confirmed POC availability significantly increases real-world exploitation probability; (3) The vulnerability is not patched (no patch version information available), leaving all installations of v1.0 vulnerable; (4) SQL injection typically enables data exfiltration, modification, and deletion—impacting Confidentiality, Integrity, and Availability equally (C:L/I:L/A:L reflects conservative CVSS scoring but actual impact may be higher); (5) Inventory Management Systems often contain sensitive business data (stock levels, pricing, customer information), making exploitation particularly damaging. This is a real, immediate priority—not a false alarm from high CVSS alone.

An attacker discovers the vulnerable /changeUsername.php endpoint and crafts a malicious HTTP POST request with a SQL injection payload in the user_id parameter, such as: POST /changeUsername.php with user_id=1' OR '1'='1' UNION SELECT password FROM users-- or user_id=1; DROP TABLE users;--. Since the parameter is not sanitized, the injected SQL executes in the database context. The attacker can: (1) extract sensitive data (usernames, passwords, inventory data) via UNION-based injection; (2) modify user credentials or inventory records; (3) escalate privileges by updating user roles; or (4) delete critical tables to cause denial of service. Given the low attack complexity (standard HTTP requests) and no authentication requirement, exploitation can be automated at scale. Public POC availability means attackers can use ready-made exploit code within hours of CVE publication.