SQL Injection Vulnerability in Code-Projects Point of Sales and Inventory Management System
CVE-2025-0199

6.5MEDIUM

Key Information:

Vendor

Code-Projects

Status
Point Of Sales And Inventory Management System
Vendor
CVE Published:
3 January 2025

What is CVE-2025-0199?

A vulnerability has been identified in the Code-Projects Point of Sales and Inventory Management System that enables SQL injection attacks via the /user/minus_cart.php file. The vulnerability arises due to improper handling of user-supplied input, particularly the 'id' parameter. An attacker can exploit this weakness remotely, potentially leading to unauthorized access to sensitive databases and manipulation of critical data. The exploit has been made publicly available, escalating the urgency for users of this software to implement appropriate security measures.

References

https://code-projects.org/
https://gist.github.com/Masamuneee/eff0a0865d54305faa7862...
https://vuldb.com/?ctiid.290136

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.
CVE-2025-0199 : SQL Injection Vulnerability in Code-Projects Point of Sales and Inventory Management System