Dairy Farm Shop Management System
Monthly
SQL injection in PHPGurukul Dairy Farm Shop Management System 1.3 allows low-privileged remote attackers to manipulate database queries via the
SQL injection in PHPGurukul Dairy Farm Shop Management System 1.3 allows low-privileged remote attackers to manipulate the 'del' parameter in invoices.php, potentially compromising the backend database. Public exploit code is available, but no active exploitation (CISA KEV) has been detected, and EPSS indicates a very low exploitation probability (0.04%).
SQL injection in PHPGurukul Dairy Farm Shop Management System 1.3 allows authenticated remote attackers to manipulate database queries via the invid parameter in view-invoice.php. An attacker with low-privilege access can exploit this to exfiltrate or modify data. Exploit code is publicly available, but no active exploitation has been confirmed.
Remote SQL injection in PHPGurukul Dairy Farm Shop Management System 1.3 via the categorycode parameter in edit-category.php allows low‑privilege authenticated attackers to execute arbitrary SQL commands. Public exploit code is available, but the EPSS score (0.04%) indicates very low exploitation probability, and no active exploitation has been confirmed.
SQL injection in PHPGurukul Dairy Farm Shop Management System 1.3 allows remote authenticated attackers to execute arbitrary SQL commands via the companyname parameter in edit-company.php. A public exploit exists, but no active exploitation has been reported; the EPSS score is low (0.04%), indicating limited exploitation likelihood despite the critical classification in the description.
We need to produce a JSON output per the instructions. Let's gather data: CVE ID: CVE-2025-7588 Description: Critical vulnerability in PHPGurukul Dairy Farm Shop Management System 1.3, affects edit-product.php, productname parameter leads to SQL injection. Attack remote. Exploit disclosed publicly. CVSS vector provided: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X We need to calculate CVSS 3.1 ourselves and assess risk. CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), but description says SQL injection, which typically goes under CWE-89. But CWE-74 is broader injection. We'll note CWE-74 from input. EPSS: 0.04%, percentile 12% - very low exploitation probability. POC: Publicly available (exploit disclosed to public, may be used). KEV: not mentioned, not in KEV. Patch: No info about patch. No vendor advisory beyond references. References include vuldb entries and GitHub issue (exploit). No fix version. CPE: cpe:2.3:a:phpgurukul:dairy_farm_shop_management_system:1.3:*:*:*:*:*:*:* Tags: PHP, SQLi Other: Reported by cna@vuldb.com, so it's a vuldb entry. EUVD ID number. Affected products from EUVD: Dairy Farm Shop Management System 1.3 only. Now, analysis: product_name: "PHPGurukul Dairy Farm Shop Management System" - that's a specific product, but the request says 1-3 words only, maybe "Dairy Farm Shop Management System" (4 words) or "Dairy Farm System"? The product is PHPGurukul Dairy Farm Shop Management System. I'd pick "Dairy Farm Shop Management System" but that's 4 words. 1-3 words: "Dairy Farm System" is too generic. "PHPGurukul DFMS"? Better: "PHPGurukul Dairy Farm System" (4 words) or "Dairy Farm Shop System". Given the description says "PHPGurukul Dairy Farm Shop Management System 1.3", I'll use "Dairy Farm Shop System" (3 words) but that might lose vendor. The rule: "product_name": "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the vendor alone, NOT a description. If multiple products, pick the primary one." So for a product named "Dairy Farm Shop Management System", it's a specific product. I'd go with "Dairy Farm Shop MS" or just "Dairy Farm System". But the examples show "GoAnywhere MFT" which is a product with acronym. I think "Dairy Farm System" is too generic. Maybe "DF Shop Management"? No. I'll pick "Dairy Farm Shop System" but that's 3 words. "Dairy Farm Shop" is 3 words. Actually "Dairy Farm Shop Management System" - I need the primary product name. "Dairy Farm Shop Management System" is the full name. The instruction says 1-3 words. I could truncate: "Dairy Farm System" (3 words) - but that misplaces the "shop"? I think the intent is not to give full name but concise. Another approach: Use the product as named in CPE: "dairy_farm_shop_management_system", but human-readable: "Dairy Farm Shop System" is acceptable. I'll go with "Dairy Farm Shop System" as 3 words. However, the requested examples: "WordPress" (one word), "Apache Tomcat" (two words), "Linux Kernel" (two words). So I need a short product name. "Dairy Farm System" is short and captures the essence, but the product is specifically for dairy farm shop. I'll go with "Dairy Farm System" (3 words). Better: "Dairy Farm Shop System" (4 words, too many). So "Dairy Farm System" (3 words). That's likely sufficient. I'll output "Dairy Farm System" but note it's PHPGurukul's. The product_name field is just the primary product name, not vendor. So I'll do "Dairy Farm Shop System" if I can, but 3 word limit: "Dairy Farm System" fits. I'll settle for "Dairy Farm System". summary: Need original synthesis, not copying description. Start with impact verb and product. Impact: SQL injection allows remote attackers to manipulate productname parameter, potentially leading to data manipulation or retrieval. So: "SQL injection in PHPGurukul Dairy Farm Shop Management System 1.3 allows remote attackers to inject SQL commands via the 'productname' parameter in edit-product.php. The vulnerability has a public exploit, but active exploitation is not confirmed; EPSS score is low (0.04%)." I can phrase: "SQL injection in PHPGurukul Dairy Farm System 1.3 allows remote attackers to execute arbitrary SQL via the edit-product.php 'productname' parameter. This can lead to data breach or manipulation, and a public proof-of-concept exists. Despite critical classification, CVSS 4.0 scored it moderate due to low impact metrics." technical_context: Use CPE to identify exact product. PHPGurukul Dairy Farm Shop Management System 1.3 is a PHP-based web application. edit-product.php is a server-side script that likely handles product editing, and the 'productname' argument is vulnerable to SQL injection due to improper input sanitization (CWE-74, or more precisely CWE-89). The attack is initiated remotely over the network, as indicated by CVSS AV:N. risk_assessment: CVSS vector provided is 4.0: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That means network, low attack complexity, no user interaction, but requires low privileges (PR:L). Impact on vulnerable system: all low (VC:L, VI:L, VA:L). Subsequent system impact none. Exploit maturity: E:P (proof-of-concept). This vector results in a CVSS 4.0 score of around 5.1? Let's compute: Base score formula for 4.0 with these metrics: AV:N=0.2, AC:L=0.77, AT:N=0, PR:L=0.11, UI:N=0.13, VC:L=0.23, VI:L=0.23, VA:L=0.23, SC:N=0, SI:N=0, SA:N=0. The formula is complex, but given low impact and low privileges, score would be around 4.6-5.3. The given CVSS vector didn't include a score, but we can infer it's around that. EPSS 0.04% indicates very low likelihood of exploitation in the wild. No KEV, so not actively exploited. POC publicly available. So risk is limited: low privileges needed, but exploitation yields low confidentiality, integrity, and availability impact. The vulnerability is in a niche product, which reduces real-world risk. Overall, it's a low-to-moderate risk despite public exploit. I need to compare and contrast: CVSS 4.0 suggests moderate base score (maybe 5.1), but EPSS low, and low impact metics. So it's not a high risk. I'll state that the vector indicates that authentication (low privilege) is needed, so it's not unauthenticated, limiting widespread impact. Also the product appears to be a small-scale management system, so prevalence is low. affected_products: The input provides exact product and version: PHPGurukul Dairy Farm Shop Management System version 1.3. CPE: cpe:2.3:a:phpgurukul:dairy_farm_shop_management_system:1.3. No vendor advisory link in references, only the vuldb links and GitHub. So I'll list the affected product with version and note that it's the only known affected version. I'll mention that no patches are indicated and that users should check for updates from the vendor. I'll include the reference to the vuldb advisory for details. remediation: No patch mentioned. So no vendor patch. I'll suggest workarounds: Since it's SQL injection in the productname parameter, possible mitigations: Input validation and parameterized queries. But that's for developers. For end users, they could restrict access to the admin panel or disable edit-product.php until a fix is available. I'll mention that no official patch exists, and users should monitor vendor for updates or apply coding fixes themselves. I'll reference the vuldb entry ID 316287 for details. I'll note that the product is a PHP application; a temporary workaround is to restrict access to the edit-product.php script to trusted users only, but that's not a fix. exploit_scenario: An attacker with low-privilege access (e.g., an authenticated user) can send a crafted POST request to edit-product.php with malicious SQL in the 'productname' field. Successful exploitation could allow extraction of database data, such as user credentials or product listing. The attack complexity is low because no special bypass is needed beyond basic SQL injection techniques. exploitation_conditions: According to the CVE description and CVSS vector, the attack requires low privileges (PR:L), meaning an attacker must have some authenticated access to the application. The specific condition is that user must be able to reach the edit-product.php page and interact with the product editing functionality. There is no indication that the vulnerability affects the default configuration; it is likely accessible to any authenticated user with product editing rights. So exploitation requires an authenticated session with permissions to edit products. I'll state: "Exploitation requires authenticated access to the application (low-privilege user account) and the ability to submit data to the edit-product.php endpoint. No special configuration beyond default product editing role is needed." That's specific. attack_chain: Needs 3-7 steps. Using kill chain phases: Access -> Exploit -> Impact. Since requires low privilege, attacker first obtains authenticated session (Access). Then send crafted request to edit-product.php -> inject SQL via productname -> execute arbitrary SQL -> extract/alter data. So chain: "Obtain low-privilege authenticated session (e.g., registered user) → Send crafted HTTP POST request to edit-product.php with malicious SQL in productname parameter → SQL injection executes in backend database → Attacker reads, modifies, or deletes database records." That's 4 steps. So: "Obtain low-privilege authenticated session → Send crafted POST request to /edit-product.php → Inject SQL via productname parameter → Read or modify database contents." Good. confidence_notes: The vulnerability is confirmed by NVD and VulDB; the CVSS 4.0 vector is provided, public exploit exists via GitHub. No vendor advisory found, and no patch version is indicated. EPSS score is low, and no evidence of active exploitation. Missing: vendor-provided fix, exact exploit details beyond GitHub issue, and active exploitation status. I'll state: "Exploit confirmed via public disclosure and GitHub. No vendor patch identified. EPSS low, no active exploitation observed at this time. CVSS 4.0 base vector available; impact metrics are low." prevalence: The product is a dairy farm shop management system, likely a niche PHP application, not widely deployed. So prevalence should be "low". I'll pick "low". prevalence_basis: "niche PHPGurukul project for small dairy farm shops" or similar. I'll say "niche web application with limited enterprise deployment". assessed_cvss_vector: Need to calculate my own CVSS 3.1 vector based on description. The CVSS 4.0 vector provided is: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. Mapping to 3.1: AV:N (Network), AC:L (Low), PR:L (Low), UI:N (None), S:U (no scope change since subsequent impact is all N? Actually S is scope; if all subsequent impacts are N, then scope is unchanged. So I'll set S:U), Confidentiality Impact C:L (low), I:L, A:L. So CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. That's a base score of
A SQL injection vulnerability was discovered in the PHPGurukul Dairy Farm Shop Management System 1.3. The vulnerability allows remote attackers to execute arbitrary SQL code via the category and categorycode parameters in a POST request to the manage-categories.php file.
A time-based blind SQL injection vulnerability was identified in the PHPGurukul Dairy Farm Shop Management System 1.3. The vulnerability exists in the manage-companies.php file and allows remote attackers to execute arbitrary SQL code via the companyname parameter in a POST request.
A critical SQL injection vulnerability exists in PHPGurukul Dairy Farm Shop Management System version 1.3 within the /search-product.php endpoint, specifically in the 'productname' parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the database. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation a significant risk.
PHPGurukul Dairy Farm Shop Management System version 1.3 contains a critical SQL injection vulnerability in the /sales-report-details.php file affecting the fromdate and todate parameters. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with working proof-of-concept code available, making active exploitation likely in the wild.
SQL injection vulnerability in PHPGurukul Dairy Farm Shop Management System version 1.3, specifically in the /profile.php file's mobilenumber parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has public exploit code available and carries a CVSS score of 7.3 (high severity), though the actual exploitability depends on database configuration and input filtering implementation.
Critical SQL injection vulnerability in PHPGurukul Dairy Farm Shop Management System version 1.3, specifically in the /bwdate-report-details.php file where the fromdate and todate parameters are inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The exploit has been publicly disclosed with proof-of-concept availability, indicating active exploitation risk.
PHPGurukul Dairy Farm Shop Management System version 1.3 contains a critical SQL injection vulnerability in the /add-product.php file's productname parameter that allows unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with proof-of-concept code available, creating immediate risk for all exposed installations. With a CVSS score of 7.3 (High) and evidence of public disclosure, this vulnerability should be prioritized for remediation despite the moderate CVSS rating.
Critical SQL injection vulnerability in PHPGurukul Dairy Farm Shop Management System version 1.3, specifically in the /add-company.php file where the 'companyname' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to data theft, modification, or deletion. The exploit has been publicly disclosed and proof-of-concept code is available, significantly increasing real-world exploitation risk.
PHPGurukul Dairy Farm Shop Management System v1.1 is vulnerable to Cross-Site Scripting (XSS) via the pname parameter in add_product.php and edit_product.php. Rated medium severity (CVSS 5.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in PHPGurukul Dairy Farm Shop Management System up to 1.1. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in Dairy Farm Shop Management System Using PHP and MySQL v1.1 allow attackers to execute arbitrary web scripts and HTML via a crafted payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dairy Farm Shop Management System Using PHP and MySQL v1.1 was discovered to contain multiple SQL injection vulnerabilities in the Login function via the Username and Password parameters. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via bwdate-report-ds.php file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via sales-report-ds.php file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Management System v1.0 allows attackers to bypass authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to XSS, as demonstrated by the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php,. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parameter in index.php, the category and CategoryCode parameters in add-category.php,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in PHPGurukul Dairy Farm Shop Management System 1.3 allows low-privileged remote attackers to manipulate database queries via the
SQL injection in PHPGurukul Dairy Farm Shop Management System 1.3 allows low-privileged remote attackers to manipulate the 'del' parameter in invoices.php, potentially compromising the backend database. Public exploit code is available, but no active exploitation (CISA KEV) has been detected, and EPSS indicates a very low exploitation probability (0.04%).
SQL injection in PHPGurukul Dairy Farm Shop Management System 1.3 allows authenticated remote attackers to manipulate database queries via the invid parameter in view-invoice.php. An attacker with low-privilege access can exploit this to exfiltrate or modify data. Exploit code is publicly available, but no active exploitation has been confirmed.
Remote SQL injection in PHPGurukul Dairy Farm Shop Management System 1.3 via the categorycode parameter in edit-category.php allows low‑privilege authenticated attackers to execute arbitrary SQL commands. Public exploit code is available, but the EPSS score (0.04%) indicates very low exploitation probability, and no active exploitation has been confirmed.
SQL injection in PHPGurukul Dairy Farm Shop Management System 1.3 allows remote authenticated attackers to execute arbitrary SQL commands via the companyname parameter in edit-company.php. A public exploit exists, but no active exploitation has been reported; the EPSS score is low (0.04%), indicating limited exploitation likelihood despite the critical classification in the description.
We need to produce a JSON output per the instructions. Let's gather data: CVE ID: CVE-2025-7588 Description: Critical vulnerability in PHPGurukul Dairy Farm Shop Management System 1.3, affects edit-product.php, productname parameter leads to SQL injection. Attack remote. Exploit disclosed publicly. CVSS vector provided: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X We need to calculate CVSS 3.1 ourselves and assess risk. CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), but description says SQL injection, which typically goes under CWE-89. But CWE-74 is broader injection. We'll note CWE-74 from input. EPSS: 0.04%, percentile 12% - very low exploitation probability. POC: Publicly available (exploit disclosed to public, may be used). KEV: not mentioned, not in KEV. Patch: No info about patch. No vendor advisory beyond references. References include vuldb entries and GitHub issue (exploit). No fix version. CPE: cpe:2.3:a:phpgurukul:dairy_farm_shop_management_system:1.3:*:*:*:*:*:*:* Tags: PHP, SQLi Other: Reported by cna@vuldb.com, so it's a vuldb entry. EUVD ID number. Affected products from EUVD: Dairy Farm Shop Management System 1.3 only. Now, analysis: product_name: "PHPGurukul Dairy Farm Shop Management System" - that's a specific product, but the request says 1-3 words only, maybe "Dairy Farm Shop Management System" (4 words) or "Dairy Farm System"? The product is PHPGurukul Dairy Farm Shop Management System. I'd pick "Dairy Farm Shop Management System" but that's 4 words. 1-3 words: "Dairy Farm System" is too generic. "PHPGurukul DFMS"? Better: "PHPGurukul Dairy Farm System" (4 words) or "Dairy Farm Shop System". Given the description says "PHPGurukul Dairy Farm Shop Management System 1.3", I'll use "Dairy Farm Shop System" (3 words) but that might lose vendor. The rule: "product_name": "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the vendor alone, NOT a description. If multiple products, pick the primary one." So for a product named "Dairy Farm Shop Management System", it's a specific product. I'd go with "Dairy Farm Shop MS" or just "Dairy Farm System". But the examples show "GoAnywhere MFT" which is a product with acronym. I think "Dairy Farm System" is too generic. Maybe "DF Shop Management"? No. I'll pick "Dairy Farm Shop System" but that's 3 words. "Dairy Farm Shop" is 3 words. Actually "Dairy Farm Shop Management System" - I need the primary product name. "Dairy Farm Shop Management System" is the full name. The instruction says 1-3 words. I could truncate: "Dairy Farm System" (3 words) - but that misplaces the "shop"? I think the intent is not to give full name but concise. Another approach: Use the product as named in CPE: "dairy_farm_shop_management_system", but human-readable: "Dairy Farm Shop System" is acceptable. I'll go with "Dairy Farm Shop System" as 3 words. However, the requested examples: "WordPress" (one word), "Apache Tomcat" (two words), "Linux Kernel" (two words). So I need a short product name. "Dairy Farm System" is short and captures the essence, but the product is specifically for dairy farm shop. I'll go with "Dairy Farm System" (3 words). Better: "Dairy Farm Shop System" (4 words, too many). So "Dairy Farm System" (3 words). That's likely sufficient. I'll output "Dairy Farm System" but note it's PHPGurukul's. The product_name field is just the primary product name, not vendor. So I'll do "Dairy Farm Shop System" if I can, but 3 word limit: "Dairy Farm System" fits. I'll settle for "Dairy Farm System". summary: Need original synthesis, not copying description. Start with impact verb and product. Impact: SQL injection allows remote attackers to manipulate productname parameter, potentially leading to data manipulation or retrieval. So: "SQL injection in PHPGurukul Dairy Farm Shop Management System 1.3 allows remote attackers to inject SQL commands via the 'productname' parameter in edit-product.php. The vulnerability has a public exploit, but active exploitation is not confirmed; EPSS score is low (0.04%)." I can phrase: "SQL injection in PHPGurukul Dairy Farm System 1.3 allows remote attackers to execute arbitrary SQL via the edit-product.php 'productname' parameter. This can lead to data breach or manipulation, and a public proof-of-concept exists. Despite critical classification, CVSS 4.0 scored it moderate due to low impact metrics." technical_context: Use CPE to identify exact product. PHPGurukul Dairy Farm Shop Management System 1.3 is a PHP-based web application. edit-product.php is a server-side script that likely handles product editing, and the 'productname' argument is vulnerable to SQL injection due to improper input sanitization (CWE-74, or more precisely CWE-89). The attack is initiated remotely over the network, as indicated by CVSS AV:N. risk_assessment: CVSS vector provided is 4.0: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That means network, low attack complexity, no user interaction, but requires low privileges (PR:L). Impact on vulnerable system: all low (VC:L, VI:L, VA:L). Subsequent system impact none. Exploit maturity: E:P (proof-of-concept). This vector results in a CVSS 4.0 score of around 5.1? Let's compute: Base score formula for 4.0 with these metrics: AV:N=0.2, AC:L=0.77, AT:N=0, PR:L=0.11, UI:N=0.13, VC:L=0.23, VI:L=0.23, VA:L=0.23, SC:N=0, SI:N=0, SA:N=0. The formula is complex, but given low impact and low privileges, score would be around 4.6-5.3. The given CVSS vector didn't include a score, but we can infer it's around that. EPSS 0.04% indicates very low likelihood of exploitation in the wild. No KEV, so not actively exploited. POC publicly available. So risk is limited: low privileges needed, but exploitation yields low confidentiality, integrity, and availability impact. The vulnerability is in a niche product, which reduces real-world risk. Overall, it's a low-to-moderate risk despite public exploit. I need to compare and contrast: CVSS 4.0 suggests moderate base score (maybe 5.1), but EPSS low, and low impact metics. So it's not a high risk. I'll state that the vector indicates that authentication (low privilege) is needed, so it's not unauthenticated, limiting widespread impact. Also the product appears to be a small-scale management system, so prevalence is low. affected_products: The input provides exact product and version: PHPGurukul Dairy Farm Shop Management System version 1.3. CPE: cpe:2.3:a:phpgurukul:dairy_farm_shop_management_system:1.3. No vendor advisory link in references, only the vuldb links and GitHub. So I'll list the affected product with version and note that it's the only known affected version. I'll mention that no patches are indicated and that users should check for updates from the vendor. I'll include the reference to the vuldb advisory for details. remediation: No patch mentioned. So no vendor patch. I'll suggest workarounds: Since it's SQL injection in the productname parameter, possible mitigations: Input validation and parameterized queries. But that's for developers. For end users, they could restrict access to the admin panel or disable edit-product.php until a fix is available. I'll mention that no official patch exists, and users should monitor vendor for updates or apply coding fixes themselves. I'll reference the vuldb entry ID 316287 for details. I'll note that the product is a PHP application; a temporary workaround is to restrict access to the edit-product.php script to trusted users only, but that's not a fix. exploit_scenario: An attacker with low-privilege access (e.g., an authenticated user) can send a crafted POST request to edit-product.php with malicious SQL in the 'productname' field. Successful exploitation could allow extraction of database data, such as user credentials or product listing. The attack complexity is low because no special bypass is needed beyond basic SQL injection techniques. exploitation_conditions: According to the CVE description and CVSS vector, the attack requires low privileges (PR:L), meaning an attacker must have some authenticated access to the application. The specific condition is that user must be able to reach the edit-product.php page and interact with the product editing functionality. There is no indication that the vulnerability affects the default configuration; it is likely accessible to any authenticated user with product editing rights. So exploitation requires an authenticated session with permissions to edit products. I'll state: "Exploitation requires authenticated access to the application (low-privilege user account) and the ability to submit data to the edit-product.php endpoint. No special configuration beyond default product editing role is needed." That's specific. attack_chain: Needs 3-7 steps. Using kill chain phases: Access -> Exploit -> Impact. Since requires low privilege, attacker first obtains authenticated session (Access). Then send crafted request to edit-product.php -> inject SQL via productname -> execute arbitrary SQL -> extract/alter data. So chain: "Obtain low-privilege authenticated session (e.g., registered user) → Send crafted HTTP POST request to edit-product.php with malicious SQL in productname parameter → SQL injection executes in backend database → Attacker reads, modifies, or deletes database records." That's 4 steps. So: "Obtain low-privilege authenticated session → Send crafted POST request to /edit-product.php → Inject SQL via productname parameter → Read or modify database contents." Good. confidence_notes: The vulnerability is confirmed by NVD and VulDB; the CVSS 4.0 vector is provided, public exploit exists via GitHub. No vendor advisory found, and no patch version is indicated. EPSS score is low, and no evidence of active exploitation. Missing: vendor-provided fix, exact exploit details beyond GitHub issue, and active exploitation status. I'll state: "Exploit confirmed via public disclosure and GitHub. No vendor patch identified. EPSS low, no active exploitation observed at this time. CVSS 4.0 base vector available; impact metrics are low." prevalence: The product is a dairy farm shop management system, likely a niche PHP application, not widely deployed. So prevalence should be "low". I'll pick "low". prevalence_basis: "niche PHPGurukul project for small dairy farm shops" or similar. I'll say "niche web application with limited enterprise deployment". assessed_cvss_vector: Need to calculate my own CVSS 3.1 vector based on description. The CVSS 4.0 vector provided is: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. Mapping to 3.1: AV:N (Network), AC:L (Low), PR:L (Low), UI:N (None), S:U (no scope change since subsequent impact is all N? Actually S is scope; if all subsequent impacts are N, then scope is unchanged. So I'll set S:U), Confidentiality Impact C:L (low), I:L, A:L. So CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. That's a base score of
A SQL injection vulnerability was discovered in the PHPGurukul Dairy Farm Shop Management System 1.3. The vulnerability allows remote attackers to execute arbitrary SQL code via the category and categorycode parameters in a POST request to the manage-categories.php file.
A time-based blind SQL injection vulnerability was identified in the PHPGurukul Dairy Farm Shop Management System 1.3. The vulnerability exists in the manage-companies.php file and allows remote attackers to execute arbitrary SQL code via the companyname parameter in a POST request.
A critical SQL injection vulnerability exists in PHPGurukul Dairy Farm Shop Management System version 1.3 within the /search-product.php endpoint, specifically in the 'productname' parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the database. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation a significant risk.
PHPGurukul Dairy Farm Shop Management System version 1.3 contains a critical SQL injection vulnerability in the /sales-report-details.php file affecting the fromdate and todate parameters. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with working proof-of-concept code available, making active exploitation likely in the wild.
SQL injection vulnerability in PHPGurukul Dairy Farm Shop Management System version 1.3, specifically in the /profile.php file's mobilenumber parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has public exploit code available and carries a CVSS score of 7.3 (high severity), though the actual exploitability depends on database configuration and input filtering implementation.
Critical SQL injection vulnerability in PHPGurukul Dairy Farm Shop Management System version 1.3, specifically in the /bwdate-report-details.php file where the fromdate and todate parameters are inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The exploit has been publicly disclosed with proof-of-concept availability, indicating active exploitation risk.
PHPGurukul Dairy Farm Shop Management System version 1.3 contains a critical SQL injection vulnerability in the /add-product.php file's productname parameter that allows unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with proof-of-concept code available, creating immediate risk for all exposed installations. With a CVSS score of 7.3 (High) and evidence of public disclosure, this vulnerability should be prioritized for remediation despite the moderate CVSS rating.
Critical SQL injection vulnerability in PHPGurukul Dairy Farm Shop Management System version 1.3, specifically in the /add-company.php file where the 'companyname' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to data theft, modification, or deletion. The exploit has been publicly disclosed and proof-of-concept code is available, significantly increasing real-world exploitation risk.
PHPGurukul Dairy Farm Shop Management System v1.1 is vulnerable to Cross-Site Scripting (XSS) via the pname parameter in add_product.php and edit_product.php. Rated medium severity (CVSS 5.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in PHPGurukul Dairy Farm Shop Management System up to 1.1. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in Dairy Farm Shop Management System Using PHP and MySQL v1.1 allow attackers to execute arbitrary web scripts and HTML via a crafted payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dairy Farm Shop Management System Using PHP and MySQL v1.1 was discovered to contain multiple SQL injection vulnerabilities in the Login function via the Username and Password parameters. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via bwdate-report-ds.php file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via sales-report-ds.php file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Management System v1.0 allows attackers to bypass authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to XSS, as demonstrated by the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php,. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parameter in index.php, the category and CategoryCode parameters in add-category.php,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.