CVE-2025-11487
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A SQL injection vulnerability was discovered in SourceCodester Farm Management System 1.0 in /uploadProduct.php. Manipulation of the Type argument allows remote attack execution. The exploit is publicly available.
Risk Assessment
An attacker can remotely manipulate SQL queries, potentially leading to unauthorized data access or modification. Public exploit increases the risk of exploitation.
Recommendation
Apply patches or restrict access to /uploadProduct.php. Use parameterized queries to prevent SQL injection.
Other vulnerabilities in SourceCodester Farm Management System
See all- CVE-2025-13200Medium
In SourceCodester Farm Management System 1.0, there is a vulnerability exposing information through directory listing. A remote attacker can exploit this to browse directory contents.
- CVE-2025-12926Medium
A SQL injection vulnerability has been identified in SourceCodester Farm Management System 1.0 in the /review.php file via manipulation of the pid argument. The attack can be performed remotely, and the exploit has been publicly disclosed.
- CVE-2025-11486Medium
A SQL injection vulnerability exists in SourceCodester Farm Management System 1.0 in /buyNow.php. Manipulation of the Name argument allows remote attack. The exploit is publicly available.
- CVE-2025-11478Medium
A SQL injection vulnerability was identified in SourceCodester Farm Management System 1.0 in the file /myCart.php. Manipulation of the pid argument leads to SQL injection, and remote exploitation is possible. The exploit has been made publicly available and could be exploited.
Original NVD description (English source)
A security flaw has been discovered in SourceCodester Farm Management System 1.0. Affected by this issue is some unknown functionality of the file /uploadProduct.php. Performing manipulation of the argument Type results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS