CVE-2025-15243CWE-74CWE-89sql-injection

CVE-2025-15243

High · published December 30, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
40.4
In the wild
Unconfirmed
What it is

⚠️ A remote SQL injection can happen just by manipulating the Username argument on the login page of Simple Stock System 1.0! You don't want to leave your server vulnerable, do you? Think of it like a restaurant where diners can reorder dishes just by changing the name on the menu — clever, but one misstep and they could be served something utterly unexpected! An attacker could exploit this flaw to access sensitive information or manipulate your database. This could lead to unauthorized data exposure or even worse, total control over the application. It's a medium-severity issue, but don't let it slide!

Put simply

Think of it like a restaurant where diners can reorder dishes just by changing the name on the menu — clever, but one misstep and they could be served something utterly unexpected! This vulnerability allows attackers to perform SQL injection by tampering with the Username argument in the /market/login.php file, enabling them to execute arbitrary SQL commands on the database.

What to do

An attacker could exploit this flaw to access sensitive information or manipulate your database. This could lead to unauthorized data exposure or even worse, total control over the application. It's a medium-severity issue, but don't let it slide! To stay safe, immediately update the Simple Stock System to the latest version that addresses this vulnerability. Implement input validation to sanitize the Username argument and consider using prepared statements to safeguard against SQL injections. You've got this! Follow these steps, and you’ll bolster your defenses in no time. 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00479 · 40.4th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-12-30T15:15Z
Affected products (1)
ProductVersionsFixed in
carmelo/simple_stock_systemall versions—
References (5)
EPSS history
Timeline
  • 30 DEC 10:02Z
    code-projects Simple Stock System login.php sql injection
    cvelistv5