SQL Injection Vulnerability in Point of Sales and Inventory Management System by Code-Projects
CVE-2025-0196
6.5MEDIUM
Summary
A significant security vulnerability has been identified in the Point of Sales and Inventory Management System version 1.0 by Code-Projects. This issue resides within the file /user/plist.php, specifically affecting the handling of the 'cat' argument, which allows for SQL injection attacks. Attackers can exploit this vulnerability remotely, leading to unauthorized database access or manipulation. The existence of publicly disclosed exploits raises concerns for users of this system, underscoring the necessity for immediate attention and remediation.
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published