Mobile Shop EUVD-2025-21359

This vulnerability presents HIGH real-world risk despite the moderate CVSS 7.3 score. Risk signals analysis: (1) CVSS Vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible, low-complexity exploitation requiring no privileges or user interaction—maximally favorable for attackers; (2) Public PoC availability dramatically increases exploitation probability and real-world threat; (3) Authentication bypass capability (login.php) has TECHNICAL IMPACT rated as HIGH—directly affecting confidentiality, integrity, and availability; (4) SSVC framework would classify this as IMMEDIATE/CRITICAL due to: exploitation being active/public, no patch likely (legacy product), automatable attack, and high technical impact on authentication; (5) The application appears to be a legacy/abandoned product (Mobile Shop 1.0 with no newer versions mentioned), reducing patch availability likelihood. Comparison: While CVSS 7.3 is not the highest possible score, the combination of public PoC + authentication bypass + remote/unauthenticated attack vector makes this a PRIORITY issue that warrants immediate action, unlike higher-scoring but less-exploitable vulnerabilities.

An attacker identifies a target running code-projects Mobile Shop 1.0 and navigates to the login page (/login.php). Instead of entering a legitimate email, the attacker submits a SQL injection payload in the email field, such as: admin' OR '1'='1' or ' UNION SELECT username, password FROM users WHERE '1'='1. Due to AV:N/AC:L/PR:N characteristics, this attack requires only network access and is trivially automatable. The vulnerable /login.php code processes this unsanitized input directly in a SQL query (e.g., SELECT * FROM users WHERE email='[user_input]'), breaking the query syntax and allowing the injected SQL to execute. Outcomes may include: (1) Authentication bypass—logging in as an arbitrary user (admin) without a password; (2) Data extraction—dumping the entire user table, password hashes, or PII; (3) Database modification—inserting new admin accounts or modifying existing credentials; (4) Privilege escalation—if the database user has elevated permissions. Given public PoC availability, this attack can be executed by novice attackers using existing exploit tools within seconds, making it suitable for mass exploitation campaigns targeting poorly-maintained deployments.