CVE-2025-9761

Vulnerability

Details

The vulnerability is a SQL injection in the login mechanism of the Online Feeds Product Inventory System version 1.0, specifically in the file /feeds/index.php [2]. The root cause is improper sanitization of the 'username' parameter, which is directly concatenated into SQL queries without validation or escaping [2]. This allows an attacker to inject malicious SQL code through the username field during authentication.

Exploitation

Exploitation is performed remotely via HTTP POST requests to the /feeds/index.php endpoint [2]. No authentication or prior access is required. The provided payloads indicate a boolean-based blind SQL injection technique, likely using MySQL comments to bypass restrictions [2]. The vulnerability can be triggered with simple crafted input, making it accessible to attackers with minimal skill.

Impact

Successful exploitation enables an attacker to execute arbitrary SQL commands, leading to unauthorized access to the database [2]. This can result in data leakage, modification or deletion of sensitive information, and potentially full control of the underlying system [2]. The disclosure of the exploit code increases the risk of active attacks.

Mitigation

As of the publication date, no official patch has been released by the vendor [1]. The vendor's website appears to be a general source code repository, and no specific update for this product has been identified [1]. Users should consider disabling remote access to the vulnerable endpoint or implementing input validation and prepared statements as a workaround until a patch is available.