by Kastro
Paper/Archive/CVE-2025-4193

CVE-2025-4193

itsourcecode Restaurant Management System — itsourcecode Restaurant Management System category_update.php sql injection

EPSS 0.6%public exploitCVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 48.9.489 × 209.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability was found in itsourcecode Restaurant Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/category_update.php. The manipulation of the argument Category leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Affected

ProductAffectedFixed inSource
Restaurant Management System1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
VulDB (CNA)7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
VulDB (CNA)6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

writeupvuldb.com/?id.306806refvuldb.com/?ctiid.306806writeupvuldb.com/?submit.561849exploitgithub.com/ARPANET-cybersecurity/vuldb/issues/5refitsourcecode.comexploitgithub.com/XuepengZhao-insp/vuldb/issues/5