Inventory Management System EUVD-2025-18862

While the CVSS v3.1 score of 7.3 (High) indicates substantial risk, multiple factors elevate real-world exploitability: (1) Attack Vector is Network with no authentication required (PR:N), making it trivially accessible; (2) Attack Complexity is Low, requiring no special conditions; (3) Public exploit disclosure and proof-of-concept availability mean weaponized code exists; (4) The vulnerability affects a web-facing administrative function with full database access. However, the Impact Scope is Unchanged (S:U) and impact is partial (C:L/I:L/A:L) rather than complete. EPSS data is unavailable here, but the combination of network-accessible, unauthenticated, low-complexity SQL injection with public POC warrants immediate remediation. This is NOT a 'high-CVSS-but-low-risk' issue—this is a genuinely exploitable, actively disclosed vulnerability in active use systems.

An unauthenticated attacker (e.g., external threat actor) discovers the application at a target organization's domain. The attacker crafts an HTTP request to /php_action/editCategories.php with a malicious payload in the editCategoriesName parameter, such as: editCategoriesName=test' OR '1'='1 or editCategoriesName=test'; DROP TABLE users;--. Because the parameter is directly concatenated into a SQL query without sanitization, the injected SQL executes in the database context of the application user. The attacker could read all database records (product inventory, pricing, customer data), modify records (alter inventory counts or prices), or delete tables entirely (Denial of Service). A proof-of-concept tool automating this attack is publicly available, enabling mass exploitation. No user interaction or special network conditions are required—a single HTTP request from the public internet suffices. An attacker could automate exploitation of multiple targets systematically.