Inventory Management System EUVD-2025-19140

Risk signals present a moderately elevated but actionable threat profile. CVSS 7.3 with AV:N/AC:L/PR:N/UI:N indicates network-exploitable, low-complexity attack requiring no authentication—a concerning combination. However, impact ratings of L (Low) across C/I/A suggest the vulnerability does not directly compromise system availability or lead to complete data exfiltration in all scenarios. The public disclosure of exploits significantly increases real-world exploitation probability. While EPSS data is not provided, the combination of public POC availability, unauthenticated remote access, and SQL injection's natural automatable nature suggests high exploitation likelihood. Under SSVC framing: exploitation is confirmed public, the attack is automatable (SQL injection is database-agnostic), and technical impact is substantial (database compromise). This is a HIGH priority for organizations running affected versions, particularly those exposed to untrusted networks.

An attacker discovers the Inventory Management System deployed on a public-facing server. They craft a malicious HTTP request to /php_action/fetchSelectedBrand.php?brandId=1' OR '1'='1 (or similar SQL injection payload). Due to lack of input sanitization, this payload is concatenated directly into a SQL query such as SELECT * FROM brands WHERE id = '1' OR '1'='1'. The query returns all brand records, allowing the attacker to enumerate the database schema. With subsequent requests using UNION-based or time-based blind SQL injection techniques, the attacker extracts sensitive data (user credentials, financial records, personal information) or executes database-level commands. Because the attack vector is network-accessible, requires no authentication, and has low complexity, an attacker with basic SQL injection knowledge can execute this attack in seconds. Public POC availability means this is likely already weaponized in automated attack tools and mass-scanning campaigns.