{"metadata": {"vulnerability": "CVE-2025-14568", "count": 17, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 11}}, "data": [{"timestamp": "2025-12-12T00:00:00Z", "date_only": false, "value": "2025-12-12T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / VulDB", "record": "CVE-2025-14568", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2025-12-12T01:00:00Z", "date_only": false, "value": "2025-12-12T01:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / VulDB", "record": "CVE-2025-14568", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2025-12-12T11:14:51.936Z", "date_only": false, "value": "2025-12-12T11:14:51.936Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-14568", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-12-12T12:19:59Z", "date_only": false, "value": "2025-12-12T12:19:59.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / VulDB", "record": "CVE-2025-14568", "field": "containers.cna.timeline.2.time"}, {"timestamp": "2025-12-12T18:02:06.640Z", "date_only": false, "value": "2025-12-12T18:02:06.640Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-14568", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-12-12T18:02:06.640Z", "date_only": false, "value": "2025-12-12T18:02:06.640Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulDB", "record": "CVE-2025-14568", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-12-12T19:16:01Z", "date_only": false, "value": "2025-12-12T19:16:01Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-WQC3-P5RH-9JF8", "record": "GHSA-WQC3-P5RH-9JF8", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-12-12T19:16:01.237Z", "date_only": false, "value": "2025-12-12T19:16:01.237", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-14568", "record": "FKIE_CVE-2025-14568", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-12-12T19:24:30.921Z", "date_only": false, "value": "2025-12-12T19:24:30.921118Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-14568", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-12-12T19:24:30.921Z", "date_only": false, "value": "2025-12-12T19:24:30.921118Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-14568", "record": "FKIE_CVE-2025-14568", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-12-12T19:24:47.913Z", "date_only": false, "value": "2025-12-12T19:24:47.913Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-14568", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-12-12T19:24:47.913Z", "date_only": false, "value": "2025-12-12T19:24:47.913Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-14568", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-12-12T19:45:17.112Z", "date_only": false, "value": "2025-12-12T19:45:17.112655Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3m7su24oibx2u", "record": "CVE-2025-14568", "field": "creation_timestamp", "uuid": "16d1f0a9-78a0-437b-8168-6c02559bc146", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3m7su24oibx2u"}, {"timestamp": "2025-12-12T21:31:38Z", "date_only": false, "value": "2025-12-12T21:31:38Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-WQC3-P5RH-9JF8", "record": "GHSA-WQC3-P5RH-9JF8", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-12-12T21:31:38Z", "date_only": false, "value": "2025-12-12T21:31:38Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-WQC3-P5RH-9JF8", "record": "GHSA-WQC3-P5RH-9JF8", "field": "modified"}, {"timestamp": "2026-08-10T17:07:51.876Z", "date_only": false, "value": "2026-08-10T17:07:51.876069Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/qianqiusujiu/aac85c8baf201da8e39e56db374ad249", "record": "CVE-2025-14568", "field": "creation_timestamp", "uuid": "11d354bb-9f7b-49cd-99c8-06ea2af3d267", "content": "# Vulnerabilities in stock-management-system (haxxorsid/stock-management-system)\n\n**Product:** stock-management-system  \n**Vendor:** haxxorsid  \n**Repository:** https://github.com/haxxorsid/stock-management-system  \n**Affected version:** latest commit at time of audit (HEAD, shallow clone)  \n**Vulnerability types:** SQL Injection (CWE-89), Broken Access Control (CWE-862)  \n**Severity:** 10 High, 0 Medium  \n**Disclosure date:** 2026-08-11  \n\n## Summary\n\nstock-management-system is a small PHP web application. A code review identified 10 security issues (10 high, 0 medium) caused by untrusted user input reaching dangerous sinks without proper sanitization / parameterized queries.\n\n## Affected endpoints / root causes\n\n### V1 \u2014 Unauthenticated SQL Injection via unvalidated `id` in Customer model (UPDATE/DELETE)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Customer.php:60`  \n- **Entry point:** PATCH /api/customers (body id) and DELETE /api/customers (body id)  \n- **Prerequisite:** None (ApiRoutes::invoke performs no Auth::userLogged() check; endpoint is unauthenticated)  \n- **Trigger chain:** $_REQUEST['id'] -> CustomerController::update/delete -> Customer::update/delete -> mysqli query \"UPDATE customers ... WHERE id=\" . $data['id'] / \"DELETE ... WHERE id='$id'\"  \n- **Proof of Concept:**  \n```\nPATCH /api/customers HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1 OR 1=1-- -&name=Test&address=addr&email=a@b.com&phone=1234567890\n\nDELETE /api/customers HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for all id values (e.g. $stmt=$conn->prepare(\"DELETE FROM customers WHERE id=?\")); cast id to int; or enforce API authentication in ApiRoutes::invoke.  \n- **Dedup note:** CLEAN  \n\n### V2 \u2014 Unauthenticated SQL Injection via unvalidated `id` in Employee model (UPDATE/DELETE)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Employee.php:59`  \n- **Entry point:** PATCH /api/employees (body id) and DELETE /api/employees (body id)  \n- **Prerequisite:** None (ApiRoutes performs no authentication; note CVE-2025-14567 already covers the missing-auth of /api/employees, but the Employee-model SQLi sink itself is not covered by CVE-2025-14568 which names model/User.php)  \n- **Trigger chain:** $_REQUEST['id'] -> EmployeeController::update/delete -> Employee::update/delete -> mysqli query \"... WHERE id=\" . $data['id'] / \"DELETE ... WHERE id='$id'\"  \n- **Proof of Concept:**  \n```\nPATCH /api/employees HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1 OR 1=1-- -&name=Test&address=addr&phone=1234567890&gender=M&doj=2020-01-01\n\nDELETE /api/employees HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for id; cast id to int; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V3 \u2014 Unauthenticated SQL Injection via `id` and `address` in Merchant model (UPDATE/DELETE/INSERT)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Merchant.php:63`  \n- **Entry point:** PATCH /api/merchants (id), DELETE /api/merchants (id), POST /api/merchants (address)  \n- **Prerequisite:** None (unauthenticated API)  \n- **Trigger chain:** $_REQUEST['id'] -> Merchant::update/delete \"WHERE id=\" . $data['id'] / \"WHERE id='$id'\"; $_REQUEST['address'] only length-validated by ValidateParams::address (htmlspecialchars does not escape single quotes for SQL) -> Merchant::insert/update string-concatenated into SQL  \n- **Proof of Concept:**  \n```\nDELETE /api/merchants HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n\nPOST /api/merchants HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nname=Shop&address=x',(SELECT 1 FROM (SELECT SLEEP(5))x),'&email=a@b.com&phone=1234567890\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements; validate/cast id; escape or bind address; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V4 \u2014 Unauthenticated SQL Injection via unvalidated `name` (and `id`) in Product model  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Product.php:27`  \n- **Entry point:** POST /api/products (name), PATCH /api/products (name,id), DELETE /api/products (id)  \n- **Prerequisite:** None (unauthenticated API)  \n- **Trigger chain:** ValidateParams::productName only checks strlen<=35 (does NOT block single quotes) -> Product::insert \"INSERT INTO products (name) VALUES ('\" . $data['name'] . \"')\" / Product::update name / Product::delete id; all concatenated into mysqli query  \n- **Proof of Concept:**  \n```\nPOST /api/products HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nname=x'),(SELECT 1 FROM (SELECT SLEEP(5))x),('\n\nDELETE /api/products HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for name and id; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V5 \u2014 Unauthenticated SQL Injection via unvalidated `id` in Rate model (UPDATE/DELETE)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Rate.php:67`  \n- **Entry point:** PATCH /api/rates (body id) and DELETE /api/rates (body id)  \n- **Prerequisite:** None (unauthenticated API)  \n- **Trigger chain:** $_REQUEST['id'] -> RateController::update/delete -> Rate::update/delete -> mysqli query \"... WHERE id=\" . $data['id'] / \"DELETE ... WHERE id='$id'\"  \n- **Proof of Concept:**  \n```\nDELETE /api/rates HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n\nPATCH /api/rates HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1 OR 1=1-- -&rate=1.0&date=2020-01-01\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for id; cast id to int; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V6 \u2014 Unauthenticated SQL Injection via unvalidated `id` in Stock model (UPDATE/DELETE)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Stock.php:68`  \n- **Entry point:** PATCH /api/stocks (body id) and DELETE /api/stocks (body id)  \n- **Prerequisite:** None (unauthenticated API)  \n- **Trigger chain:** $_REQUEST['id'] -> StockController::update/delete -> Stock::update/delete -> mysqli query \"... WHERE id=\" . $data['id'] / \"DELETE ... WHERE id='$id'\" (weight/purity/merchant_id/product_id are int-validated but id is not)  \n- **Proof of Concept:**  \n```\nDELETE /api/stocks HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n\nPATCH /api/stocks HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1 OR 1=1-- -&weight=1&purity=1&merchant_id=1&dop=2020-01-01 00:00:00\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for id; cast id to int; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V7 \u2014 Unauthenticated SQL Injection via unvalidated `id` in Transaction model (UPDATE/DELETE)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/Transaction.php:69`  \n- **Entry point:** PATCH /api/transactions (body id) and DELETE /api/transactions (body id)  \n- **Prerequisite:** None (unauthenticated API)  \n- **Trigger chain:** $_REQUEST['id'] -> TransactionController::update/delete -> Transaction::update/delete -> mysqli query \"... WHERE id=\" . $data['id'] / \"DELETE ... WHERE id='$id'\"  \n- **Proof of Concept:**  \n```\nDELETE /api/transactions HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n\nPATCH /api/transactions HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1 OR 1=1-- -&weight=1&purity=1&rate_id=1\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for id; cast id to int; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V8 \u2014 Unauthenticated SQL Injection via unvalidated `id` in ItemsSold model (UPDATE/DELETE)  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/ItemsSold.php:58`  \n- **Entry point:** PATCH /api/items_sold (body id) and DELETE /api/items_sold (body id)  \n- **Prerequisite:** None (unauthenticated API)  \n- **Trigger chain:** $_REQUEST['id'] -> ItemsSoldController::update/delete -> ItemsSold::update/delete -> mysqli query \"... WHERE id=\" . $data['id'] / \"DELETE ... WHERE id='$id'\"  \n- **Proof of Concept:**  \n```\nDELETE /api/items_sold HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1' OR '1'='1\n\nPATCH /api/items_sold HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nid=1 OR 1=1-- -&stock_id=1&customer_id=1&employee_id=1&transaction_id=1&price=1&dos=2020-01-01\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters for id; cast id to int; enforce API authentication.  \n- **Dedup note:** CLEAN  \n\n### V9 \u2014 Missing Authentication/Authorization on the entire REST API (broader than CVE-2025-14567)  \n- **CWE:** CWE-862  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `routes/ApiRoutes.php:25`  \n- **Entry point:** Any request to /api/* (login, users, customers, merchants, products, rates, stocks, transactions, items_sold, stockInfo, items_sold_info, tables)  \n- **Prerequisite:** None  \n- **Trigger chain:** ApiRoutes::invoke() calls ValidateRoutes::apiValidate() but NEVER Auth::userLogged(); all API controllers run without any session/auth check, exposing full CRUD + data read to unauthenticated attackers  \n- **Proof of Concept:**  \n```\nGET /api/customers HTTP/1.1\n(returns all customer records without any session cookie)\n\nGET /api/users HTTP/1.1\n(returns all user emails/admin flags unauthenticated)\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Call Auth::userLogged() at the start of ApiRoutes::invoke() and deny unauthenticated requests (except /api/login); apply per-role access control.  \n- **Dedup note:** PARTIAL  \n\n### V10 \u2014 Unauthenticated SQL Injection / Authentication Bypass in login via `password` (model/User.php valid())  \n- **CWE:** CWE-89  \n- **Severity:** high (CVSS 9.8)  \n- **Source:** `model/User.php:14`  \n- **Entry point:** POST /api/login (password field)  \n- **Prerequisite:** None (login endpoint is unauthenticated)  \n- **Trigger chain:** LoginController::login validates password only by length (ValidateParams::password) -> User::valid() concatenates \"SELECT * FROM users WHERE email='$email' AND password='$pass'\" with unescaped $pass, allowing SQLi and auth bypass. CVE-2025-14568 names User.php args employee_id/id/admin; the login password argument is a distinct sink not enumerated there.  \n- **Proof of Concept:**  \n```\nPOST /api/login HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\nemail=admin@x.com&password=x' OR '1'='1\n```\n- **Impact:** Data extraction / authentication bypass / unauthorized data access depending on the sink.  \n- **Recommended fix:** Use prepared statements with bound parameters in User::valid(); hash passwords (password_verify) instead of comparing raw input in SQL.  \n- **Dedup note:** PARTIAL  \n\n## Remediation\nUse prepared statements / parameterized queries (PDO or mysqli prepared statements) for all SQL; validate and allowlist order-by columns; enforce authentication on every sensitive endpoint.\n\n## Disclaimer\nThis report is provided for responsible disclosure. The findings were identified via static code analysis; runtime confirmation is recommended before public release.", "url": "https://gist.github.com/qianqiusujiu/aac85c8baf201da8e39e56db374ad249"}, {"timestamp": "2026-10-07T20:10:01.970Z", "date_only": false, "value": "2026-10-07T20:10:01.970", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-14568", "record": "FKIE_CVE-2025-14568", "field": "lastModified"}], "metrics": {"as_of": "2026-10-30T08:42:02.558Z", "anchors": {"origin": {"timestamp": "2025-12-12T18:02:06.640Z", "date_only": false, "value": "2025-12-12T18:02:06.640Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-14568", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2025-12-12T18:02:06.640Z", "date_only": false, "value": "2025-12-12T18:02:06.640Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-14568", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 27787195.918755, "hours": 7718.665532987499, "days": 321.61106387447916, "min_seconds": 27787195.918755, "max_seconds": 27787195.918755, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-12-12T18:02:06.640Z", "date_only": false, "value": "2025-12-12T18:02:06.640Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-14568", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-30T08:42:02.558Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}