CVE-2025-11478
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A SQL injection vulnerability was identified in SourceCodester Farm Management System 1.0 in the file /myCart.php. Manipulation of the pid argument leads to SQL injection, and remote exploitation is possible. The exploit has been made publicly available and could be exploited.
Risk Assessment
An attacker could exploit this to gain unauthorized access to the database, potentially leading to data leakage or system integrity compromise.
Recommendation
It is recommended to update the system or apply patches, and to validate and sanitize input data in the myCart.php file.
Other vulnerabilities in SourceCodester Farm Management System
See all- CVE-2025-13200Medium
In SourceCodester Farm Management System 1.0, there is a vulnerability exposing information through directory listing. A remote attacker can exploit this to browse directory contents.
- CVE-2025-12926Medium
A SQL injection vulnerability has been identified in SourceCodester Farm Management System 1.0 in the /review.php file via manipulation of the pid argument. The attack can be performed remotely, and the exploit has been publicly disclosed.
- CVE-2025-11487Medium
A SQL injection vulnerability was discovered in SourceCodester Farm Management System 1.0 in /uploadProduct.php. Manipulation of the Type argument allows remote attack execution. The exploit is publicly available.
- CVE-2025-11486Medium
A SQL injection vulnerability exists in SourceCodester Farm Management System 1.0 in /buyNow.php. Manipulation of the Name argument allows remote attack. The exploit is publicly available.
Original NVD description (English source)
A weakness has been identified in SourceCodester Farm Management System 1.0. This issue affects some unknown processing of the file /myCart.php. This manipulation of the argument pid causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS