Barangay Profiling System EUVD-2026-64668

No authentication is required - the CVSS 4.0 vector specifies PR:N and UI:N, confirming the Resident Search endpoint is exposed to unauthenticated HTTP requests. The only prerequisite is network reachability to the residents.php script. The vulnerable parameter is the Search field in the Resident Search Functionality; exploitation is not contingent on any non-default configuration. Exploitation is constrained by the following real-world factors: the application must be deployed and reachable over the network (many instances may be localhost or LAN-only); the product is PHP-based and likely runs on a shared hosting or simple LAMP stack with a MySQL backend; and the deployment population is geographically limited to Philippine municipal government offices. There is no requirement for a specific PHP version, database privilege level beyond SELECT, or operating system.

The CVSS 4.0 score of 6.9 reflects partial (L) impact across confidentiality, integrity, and availability with no subsequent-system impact (SC/SI/SA:N), consistent with a contained database-layer injection. The E:P supplemental metric confirms a publicly available proof-of-concept, which materially elevates exploitation likelihood beyond what the base score implies. No CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis. EPSS data was not provided in the input - exploitation probability cannot be independently quantified here. The primary risk-dampening factor is prevalence: this is a niche academic/civic PHP application used in Philippine barangay (local government unit) administrations, with a tiny and geographically concentrated deployment footprint. Technically the vulnerability is trivial to exploit (AC:L, PR:N, no interaction), but the realistic pool of exposed instances is very small. Organizations running this specific system should treat it as high priority given the POC availability; the broader security community's prioritization should remain low.

An unauthenticated attacker sends a crafted HTTP GET or POST request to the publicly accessible residents.php endpoint, injecting a SQL payload into the Search parameter (e.g., appending ' OR 1=1-- to enumerate all residents). Using the publicly disclosed POC on GitHub, the attacker extracts resident personal data from the database - names, addresses, identification numbers - or modifies records without any prior authentication or user interaction required.