Critical SQLi Hits Grocery Store Management System

A critical SQL injection vulnerability, tracked as CVE-2025-63939, has been identified in anirudhkannan Grocery Store Management System version 1.0. According to the National Vulnerability Database, this flaw, stemming from improper input handling in the /Grocery/search_products_itname.php endpoint, allows attackers to inject malicious SQL queries via the sitem_name POST parameter.

This isn’t some low-priority bug; the National Vulnerability Database has assigned it a CVSS v3.1 score of 9.8, classifying it as CRITICAL. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates that it’s network-exploitable, requires low attack complexity, needs no privileges or user interaction, and can lead to complete compromise of confidentiality, integrity, and availability. Essentially, it’s a sitting duck for anyone looking to pwn a vulnerable system.