Inventory Management System EUVD-2025-18863

The risk profile presents conflicting signals requiring careful analysis: CVSS 7.3 indicates medium-to-high severity with network-accessible exploitation (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), and no user interaction needed (UI:N). However, the impact is limited to confidentiality, integrity, and availability at 'Low' (C:L/I:L/A:L), which is inconsistent with typical SQL injection scoring. The public disclosure and available POC significantly increase exploitation probability. Despite the CVSS score being 7.3, the practical risk is substantially higher given: (1) unauthenticated remote access, (2) public POC availability, (3) legacy application architecture suggesting minimal security controls, (4) SQL injection's automatable nature (high SSVC automatable score). Real-world priority should be elevated above the base CVSS score due to exploitation maturity and accessibility.

An attacker discovers the publicly disclosed POC for CVE-2025-6503 and identifies that a target organization is running code-projects Inventory Management System 1.0. The attacker crafts a malicious HTTP request to /php_action/fetchSelectedCategories.php with categoriesId parameter containing SQL injection payload such as: '1 OR '1'='1' UNION SELECT table_name FROM information_schema.tables--'. Due to the absence of authentication (PR:N) and input validation, this request is processed directly by the PHP backend, executing the attacker's injected SQL. The attacker can then enumerate database structure, extract sensitive data (customer information, inventory details, credentials), modify records, or in worst case drop tables. The low attack complexity (AC:L) and network accessibility mean exploitation can be automated and scaled against multiple vulnerable instances.