Pet Shop Management System EUVD-2026-91156

Exploitation requires an authenticated low-privilege session (CVSS PR:L) with network access to the application's administrative component, specifically the admin_reservefilter.php endpoint, and the attacker must be able to supply the 'filter' request parameter. No user interaction is needed (UI:N). The primary limiting factors are the authentication requirement (not an unauthenticated flaw) and the extremely narrow deployment base of this specific educational product; successful attack also presumes the vulnerable 1.0 version is deployed without custom input sanitization.

This is a high-CVSS-indicator-but-modest-real-risk issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a remotely reachable, low-complexity SQL injection requiring low privileges (PR:L), with partial impact across confidentiality, integrity, and availability (VC:L/VI:L/VA:L) and no scope change - yielding a modest base score of 5.3. The E:P (Proof-of-Concept) exploit-maturity flag aligns with the input's confirmation that exploit code is publicly available via GitHub. There is NO EPSS score provided in the input and NO CISA KEV listing, so 'publicly available exploit code exists' is the correct exploitation status - this must NOT be conflated with active in-the-wild exploitation. The affected filename (admin_reservefilter.php) is within an administrative area, which is consistent with the PR:L requirement, meaning an attacker needs at least a low-privilege authenticated session rather than being fully unauthenticated. The dominant risk-reducing factor is prevalence: itsourcecode Pet Shop Management System is a small tutorial/educational PHP application with negligible enterprise deployment, so despite a trivially exploitable injection class (CWE-89), real-world blast radius is very limited. Net priority is LOW-to-MEDIUM for the rare set of organizations actually running this product, and effectively negligible for mainstream enterprises.

An attacker with a low-privilege account (consistent with CVSS PR:L) sends a crafted value in the 'filter' parameter to admin_reservefilter.php, injecting SQL that the application concatenates unsafely into a database query. Because publicly available exploit code exists and the attack is network-reachable with low complexity, the attacker can extract reservation/customer data or manipulate records. A public proof-of-concept is referenced on GitHub, lowering the skill barrier to reproduce the attack.