Mobile Shop EUVD-2025-21023

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates: Network-accessible attack requiring no credentials, low complexity, no user interaction, and localized impact (not system-wide). A CVSS score of 7.3 bridges high and critical severity. Risk elevation factors: (1) Public exploit disclosure increases real-world exploitation probability; (2) No authentication required (PR:N) enables remote unauthenticated attacks; (3) SQL injection on admin login endpoint directly threatens admin account compromise and privilege escalation; (4) /LoginAsAdmin.php designation indicates attacker can bypass intended authorization controls. Mitigating factor: Impact scoped to 'Low' for each triad (C/I/A), suggesting the vulnerability enables partial data access rather than complete system takeover, though admin account compromise is severe in context. SSVC analysis: Exploitation is PUBLIC/ACTIVE, attack is AUTOMATABLE (SQL injection tooling), technical impact is HIGH (admin authentication bypass). Real-world priority: CRITICAL for any organization running Mobile Shop 1.0, as admin compromise enables complete application takeover.

An attacker discovers a publicly-accessible Mobile Shop 1.0 instance via reconnaissance. They craft a malicious HTTP POST request to /LoginAsAdmin.php with email parameter: email=admin' OR '1'='1' --. The application constructs an unsafe SQL query like: SELECT * FROM users WHERE email='admin' OR '1'='1' --' AND password='...' which returns the first admin user regardless of password match, granting admin session access. The attacker now possesses full administrative privileges to modify products, steal customer data, inject malicious code, or pivot to backend systems. Exploitation requires <5 seconds and no special tools beyond a basic HTTP client; automated scanners can detect and exploit this at scale. Given public POC availability, detection is trivial and exploitation is immediate threat.