CVE-2025-14568
Unknown Unknown - Not Provided
SQL Injection in haxxorsid Stock-Management-System User.php

Publication date: 2025-12-12

Last updated on: 2026-04-29

Assigner: VulDB

Description
A security vulnerability has been detected in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0. This impacts an unknown function of the file model/User.php. The manipulation of the argument employee_id/id/admin leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-12
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2025-12-13
EPSS Evaluated
2026-06-15
NVD
CVE-2025-14568
EUVD
EUVD-2025-203109
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
haxxorsid stock-management-system *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Detection Guidance

This vulnerability can be detected by identifying requests to the vulnerable endpoint model/User.php that include the parameters employee_id, id, or admin. You can use Google dorking with the query 'inurl:model/User.php' to find potentially vulnerable targets. On your system or network, monitoring HTTP requests for suspicious SQL injection patterns in these parameters can help detect exploitation attempts. Specific commands are not provided, but searching logs for requests containing 'employee_id=', 'id=', or 'admin=' parameters with unusual input may help. Additionally, reviewing web server logs or using web application firewalls to detect SQL injection patterns targeting these parameters is recommended. [1]

Mitigation Strategies

No known mitigations or countermeasures exist for this vulnerability in the affected product, which is no longer supported by the vendor. The recommended immediate step is to replace the affected system with an alternative product that is actively maintained and secure. Until replacement, applying strict input validation, web application firewall rules to block SQL injection attempts, and monitoring for exploitation attempts may help reduce risk, but these are not guaranteed fixes. [1]

Executive Summary

This vulnerability is a SQL injection in the haxxorsid Stock-Management-System affecting an unknown function in the file model/User.php. It occurs due to manipulation of the arguments employee_id, id, or admin, allowing an attacker to inject malicious SQL code. The attack can be performed remotely. The affected product versions are no longer supported, and the vendor did not respond to the disclosure.

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary SQL commands on the database, potentially leading to unauthorized data access, data modification, or deletion. Since the attack can be initiated remotely, it poses a significant risk to the confidentiality, integrity, and availability of the system's data.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-14568. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart