Insurance Management System EUVD-2026-107225

Exploitation targets the EditPolicyHolder.php script in the agent policy-management module by supplying a malicious Policy_no or Name parameter that is concatenated into a mysqli_query call. The supplied CVSS vector indicates no required privileges or user interaction (PR:N/UI:N), but the '/Agent/ManagePolicy/' path indicates this functionality normally resides behind an agent login, so realistic exploitation likely requires reaching an authenticated agent-portal session - authentication requirements are not definitively confirmed from the available data. Limiting factors: the software is a niche open-source project with negligible production deployment, there is no vendor patch (rolling release, maintainer unresponsive), and exploitation depends on the specific vulnerable commit being deployed.

This is a genuine but low-priority vulnerability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a trivially reachable network-based SQL injection, but the impact metrics are uniformly Low (VC:L/VI:L/VA:L) with no scope change, yielding a modest 6.9 'MEDIUM' score - contradicting any assumption that an SQLi is automatically critical. The E:P (Proof-of-Concept) exploit maturity aligns with the reported publicly available exploit code (a GitHub issue), confirming POC availability rather than active exploitation. This is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of widespread or automated exploitation - treat it as publicly-known-but-not-weaponized. A key tension: the vulnerable file sits under '/Agent/ManagePolicy/EditPolicyHolder.php', a path strongly implying an authenticated agent/operator portal, yet the official vector asserts PR:N (unauthenticated) and the description does not state any auth requirement - this discrepancy should be verified against the application's actual access controls. Overall, the obscure hobby-project nature of the affected software is the dominant risk-reducing factor; this is a high-visibility-but-low-real-risk issue outside the handful of environments that actually run this specific project.

An attacker reaches the EditPolicyHolder.php endpoint and submits a crafted value in the Policy_no or Name parameter that breaks out of the SQL query passed to mysqli_query, allowing database content to be read or manipulated. Public exploit details have been released via the project's GitHub issue tracker, lowering the skill needed to reproduce it. Because the endpoint lives under an '/Agent/' path, successful remote exploitation may in practice require access to the agent portal.