Mobile Shop EUVD-2025-21187

This vulnerability presents HIGH real-world risk across multiple dimensions: (1) CVSS 7.3 with network-accessible attack vector (AV:N) and no privilege requirements (PR:N) indicates trivial attack initiation; (2) Public disclosure with available POC significantly elevates exploitation probability; (3) Attack complexity is LOW (AC:L), meaning no special conditions are required; (4) The vulnerability impacts all three CIA triad aspects (C:L/I:L/A:L) - attackers can read sensitive data, modify records, or cause availability issues through resource exhaustion queries; (5) No authentication required (PR:N/UI:N) means any internet user can attempt exploitation. The 'critical' classification in the vulnerability description, combined with public POC availability and low technical barriers, suggests this should be treated as immediately exploitable. This is NOT a theoretical high-CVSS issue—it represents genuine, exploitable risk requiring urgent patching.

An unauthenticated attacker discovers a publicly available Mobile Shop 1.0 instance (e.g., at example-shop.com/EditMobile.php). The attacker crafts a malicious HTTP request with a SQL injection payload in the ID parameter: GET /EditMobile.php?ID=1' OR '1'='1 or GET /EditMobile.php?ID=1; DROP TABLE users;--. Due to lack of input sanitization, the injected SQL is executed against the backend database. The attacker successfully: (1) extracts user credentials and payment information via UNION-based injection; (2) modifies product prices or inventory; (3) creates administrative accounts; or (4) executes database commands causing system outages. The low attack complexity and public POC availability mean exploitation can be automated and scaled across multiple Mobile Shop deployments, making this attractive to opportunistic threat actors.