Lifestyle Store EUVD-2025-21014

CVSS 7.3 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L indicates a network-accessible vulnerability requiring no privileges or user interaction, making it easily exploitable at scale. The low attack complexity (AC:L) means no special conditions are needed. Public disclosure of exploit code significantly elevates real-world risk beyond the base CVSS score. While the impact is rated as 'Low' across confidentiality, integrity, and availability (L/L/L in CVSS), SQL injection in e-commerce applications can expose customer databases, payment information, and inventory data, making actual impact potentially severe. The classification as 'critical' in the CVE description conflicts somewhat with the CVSS 7.3 rating (which is 'High'), suggesting the analyst should treat this as HIGH priority given public exploit availability and direct database access potential. This is not a low-real-risk scenario; public POC + network-accessible SQL injection = imminent exploitation likelihood.

An unauthenticated attacker on the public internet sends an HTTP request to the vulnerable application with a crafted ID parameter containing SQL injection payload, such as: GET /cart_remove.php?ID=1 OR '1'='1 or ID=1;DROP TABLE users;--. The application processes this without sanitization, executing the attacker's SQL in the database context. The attacker can enumerate database structure, extract customer records (names, emails, addresses, possibly payment data), modify inventory or pricing, or delete records. No user interaction or special privileges are required. Given public POC availability, script-kiddies and automated scanners will likely probe for and exploit this vulnerability within hours to days of public disclosure. Attack surface is every instance of Lifeestyle Store 1.0 exposed to the internet, including unsecured test environments.