Pet Shop Management System EUVD-2026-91158

Exploitation requires reaching the administrative script admin_reject_completed.php and supplying a manipulated ID parameter; the CVSS PR:L metric and the admin_* file naming indicate the attacker needs at least low-privileged authenticated access to the application's admin/back-office area rather than fully anonymous access. No user interaction is required (UI:N) and no non-default configuration is noted, but exploitation is limited to deployments of itsourcecode Pet Shop Management System 1.0 whose admin interface is network-reachable to the attacker, which constrains the realistic exposed population.

Signals are consistent in pointing to a real but moderate-priority issue rather than an urgent emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity SQL injection that nonetheless requires some level of authentication (PR:L), and the vulnerable file name admin_reject_completed.php strongly implies an administrative/back-office context, which meaningfully narrows the exploit population. Impact is rated Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), yielding a modest 5.3 base score - unusual for a SQLi, which often enables full DB compromise, so the Low impact rating may understate real-world potential of a classic ID-based injection. A public exploit exists (E:P in the vector and a GitHub exploit reference), raising practical accessibility, but there is NO CISA KEV listing and NO EPSS score provided, so widespread or automated exploitation cannot be confirmed. The dominant mitigating factor is prevalence: itsourcecode products are small open-source/educational PHP projects with negligible enterprise deployment, so despite a public PoC this is better treated as a targeted/opportunistic risk against the few exposed instances than as a broad threat. Net: patch or remediate where this specific product is deployed, but it is not a fleet-wide priority.

A low-privileged authenticated user (or an attacker who has obtained valid credentials to the admin interface) sends a crafted value in the ID parameter to admin_reject_completed.php, injecting SQL into the backend query. Because a public proof-of-concept is available, the technique requires little skill to reproduce, allowing the attacker to read, modify, or corrupt database records such as customer, order, or account data.