CVE-2025-11478: Janobe Farm Management System SQLi Flaw

CVE-2025-11478 Overview

CVE-2025-11478 is a SQL injection vulnerability in SourceCodester Farm Management System 1.0, developed by Janobe. The flaw resides in the /myCart.php script, where the pid parameter is passed to a backend SQL query without sufficient sanitization. Authenticated remote attackers can manipulate the pid value to inject arbitrary SQL statements. Public exploit details have been disclosed, increasing the likelihood of opportunistic attacks against exposed deployments. The issue is categorized under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command) and [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote attackers with low privileges can extract, modify, or delete data from the application database by manipulating the pid parameter in /myCart.php.

Affected Products

Janobe Farm Management System 1.0
SourceCodester Farm Management System 1.0
cpe:2.3:a:janobe:farm_management_system:1.0

Discovery Timeline

2025-10-08 - CVE-2025-11478 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-11478

Vulnerability Analysis

The vulnerability exists in the /myCart.php endpoint of Janobe Farm Management System 1.0. The application accepts the pid parameter from the HTTP request and incorporates it directly into a SQL query string. Because the input is not parameterized or sanitized, an attacker can append SQL operators, UNION statements, or boolean clauses to alter the query logic.

Successful exploitation allows reading sensitive records, modifying cart data, and potentially escalating to broader database compromise depending on the privileges assigned to the application database account. The EPSS score of 0.301% indicates a low but non-zero probability of exploitation within 30 days.

Root Cause

The root cause is improper neutralization of special characters in user-controlled input ([CWE-89]). The PHP code path handling pid concatenates the parameter into a SQL query rather than using prepared statements with bound parameters. Any single quote, comment marker, or SQL keyword reaches the database engine unchanged.

Attack Vector

An attacker sends a crafted HTTP request to /myCart.php with a manipulated pid value. The attack requires low privileges (an authenticated session) but no user interaction. Because the application is web-facing, exploitation can be automated against any reachable installation. Public proof-of-concept references are available through the GitHub CVE Issue Discussion and VulDB #327596.

The vulnerability manifests when a value such as pid=1' OR '1'='1 is supplied. Refer to the VulDB CTI #327596 record for additional technical detail.

Detection Methods for CVE-2025-11478

Indicators of Compromise

HTTP requests to /myCart.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or OR 1=1 in the pid parameter.
Web server access logs showing unusually long or URL-encoded pid values from a single source IP.
Database error messages or unusual response sizes correlated with myCart.php requests.

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects the pid parameter on /myCart.php for SQL injection signatures.
Enable database query logging and alert on queries originating from the application service account that reference information_schema or system tables.
Correlate authenticated session activity with anomalous query patterns to identify low-privilege accounts probing the cart endpoint.

Monitoring Recommendations

Monitor outbound database connections from the web tier for unexpected data volumes that may indicate exfiltration.
Track repeated 500-series HTTP responses from /myCart.php, which often accompany blind SQL injection probing.
Alert on new or modified rows in user, session, or product tables outside normal business workflows.

How to Mitigate CVE-2025-11478

Immediate Actions Required

Restrict network access to the Farm Management System until a fixed release is available, allowing only trusted internal users.
Review web server and database logs for prior exploitation attempts referencing /myCart.php and the pid parameter.
Rotate database credentials used by the application if any indicator of compromise is found.

Patch Information

No official vendor patch is currently referenced in the SourceCodester Security Blog advisory tracking. Organizations operating this software should monitor the VulDB Submit Issue #667341 entry and the GitHub CVE Issue Discussion for fix availability. Until a patch ships, defenders should rely on compensating controls.

Workarounds

Place the application behind a WAF with SQL injection rule sets enabled for the pid parameter on /myCart.php.
Apply input validation at a reverse proxy layer to reject non-numeric pid values before they reach the application.
Configure the application's database account with least-privilege permissions, removing rights to DROP, ALTER, and access to unrelated schemas.

bash

# Example ModSecurity rule blocking SQLi patterns on the pid parameter
SecRule REQUEST_URI "@beginsWith /myCart.php" \
    "chain,phase:2,deny,status:403,id:1011478,\
    msg:'CVE-2025-11478 SQLi attempt on pid parameter'"
    SecRule ARGS:pid "@rx (?i)(union|select|sleep\(|or\s+1=1|--|';)" \
        "t:none,t:urlDecodeUni"