Inventory Management System EUVD-2025-19109

While the CVSS 7.3 score reflects moderate severity, multiple risk signals elevate this to HIGH real-world priority: (1) Attack Vector is Network with no authentication required (AV:N/PR:N), meaning any internet-connected user can exploit this; (2) Attack Complexity is Low (AC:L), requiring no special conditions; (3) Public disclosure and available exploit code substantially increase exploitation probability; (4) The vulnerability affects a web-accessible administrative function (category management), typically containing sensitive business data; (5) SQL injection impacts all three security pillars - Confidentiality, Integrity, and Availability are all impacted (C:L/I:L/A:L). The CVSS vector AV:N/AC:L/PR:N indicates this is trivially exploitable at scale. The primary mitigating factor is the limited scope of version 1.0, though this appears to be an older or niche product suggesting potentially unpatched deployments in the wild.

An attacker discovers an internet-facing Inventory Management System installation. They craft a malicious HTTP request to /php_action/removeCategories.php?categoriesId=1 OR 1=1 -- or similar SQL injection payload. Since PR:N and AC:L, no authentication or complex setup is required. The injected SQL executes within the database context, allowing the attacker to: extract sensitive data (product lists, pricing, customer information via UNION-based injection), modify category records or other linked data (UPDATE injection), or delete entire categories/records (DELETE injection). If database credentials have elevated privileges, attackers could potentially read files from the server (using INTO OUTFILE) or achieve remote code execution depending on database configuration. The public disclosure and available POC code mean script-kiddies can execute this attack without deep technical knowledge, likely resulting in mass scanning and exploitation across vulnerable installations.