PT-2025-33120

CVE-2025-8936

Published

2025-08-14

Updated

2025-08-15

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: 1000 Projects Sales Management System version 1.0

Description: A SQL injection issue exists in 1000 Projects Sales Management System 1.0. The vulnerability affects an unknown functionality within the /superstore/dist/dordupdate.php file. Manipulation of the select2 argument can lead to SQL injection, and the attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

Recommendations: Versions prior to 1.0 should be updated. As a temporary workaround, consider restricting access to the /superstore/dist/dordupdate.php file until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

L1Nk

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers