PT-2025-3765

CVE-2025-0176

Published

2025-01-03

Updated

2025-04-03

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions code-projects Point of Sales and Inventory Management System version 1.0

Description A critical issue affects the processing of the file /user/add cart.php, where the manipulation of the argument id/qty leads to SQL injection. The attack may be initiated remotely.

Recommendations For version 1.0, consider disabling the /user/add cart.php file or restricting access to it until a patch is available. Avoid using the id/qty argument in the affected file to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Masamune

Masamuneee

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')