SQL injection in PHPGurukul Land Record System 1.0 via the editid parameter of edit-property.php allows remote attackers to execute arbitrary SQL queries. Exploit code is publicly available, though no active exploitation is reported (not in CISA KEV). The vulnerability has a low real-world exploitation probability (EPSS 0.07%) and limited impact.
We are tasked with synthesizing a JSON analysis for CVE-2025-7752. Let's collect data: - CVE ID: CVE-2025-7752 - Description: A vulnerability was found in code-projects Online Appointment Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/deletedoctor.php. The manipulation of the argument did leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. - CVSS Score: 5.5 (Note: the string says "CVSS Score: 5.5" but the vector is CVSS 4.0, so maybe it's a CVSS 4.0 score? I see vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. So the base score is 5.5 (CVSS 4.0). CVSS 4.0 score 5.5 is medium? The base metric is AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So it's a low impact on all vulnerable system components. So indeed 5.5. - CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')). This is generic injection; SQL injection is a subset. - EPSS: 0.07%, percentile 21%. Very low exploitation probability. - POC/Exploit: Publicly available (exploit disclosed to public) - Reported by: cna@vuldb.com - CPE: cpe:2.3:a:anisha:online_appointment_booking_system:1.0:*:*:*:*:*:*:* - Tags: PHP, SQLi, Online Appointment Booking System - References: code-projects.org, github exploit, vuldb entries. - KEV status: Not provided in input. No mention of KEV, so assume not in KEV. I'll state "no public exploit identified at time of analysis" would be wrong because POC is available. But "publicly available exploit code exists" is correct. And no KEV, so not actively exploited per CISA KEV. So exploitation status: "publicly available exploit code exists". Not "confirmed actively exploited". - CVSS vector for 3.1? Not provided, need to assess independently. The given vector is CVSS 4.0. We'll need to output our own assessed CVSS 3.1 vector. From the description: Remote attack, SQL injection in /admin/deletedoctor.php via parameter "did". There's no mention of authentication required, but the file is under /admin/ which might imply authentication is needed to reach that page. The description says "unknown functionality", but most admin pages require admin login. However, the CVSS 4.0 vector says PR:N (no privileges required), meaning unauthenticated. So maybe the page is accessible without auth? The input CVSS 4.0 says PR:N. I should consider that as the assessment from the reporter. I'll craft my own assessed CVSS 3.1: AV:N, AC:L, PR:N, UI:N, S:U, C:L/I:L/A:L? SQL injection could lead to data leakage (confidentiality low), modification (integrity low), maybe availability low if data corruption. The vector they gave VC:L/VI:L/VA:L. So I'll mirror that in 3.1: C:L/I:L/A:L. So CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. But the description says "manipulation of the argument did leads to sql injection". No details on impact, but SQLi could allow reading db, maybe RCE? But low impact seems appropriate. I'll use that. Assessed CVSS 3.1 rationale: "Unprotected admin endpoint, no authentication (PR:N), low impact on all CIA." But I must ensure it's grounded. The CVSS 4.0 says PR:N, so I'll use that. I'll explain: "Remote accessible admin page without authentication, easy to exploit, limited impact on data due to SQL injection." Actually SQL injection often leads to full compromise if database permissions allow. But the vendor gave low impact, so I'll keep low. So assessed CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. CVSS 4.0 assessed vector: The same as given, but they gave base only. I'll output the same vector but since they included environmental/time metrics, I'll just give the base vector I assess, which is consistent with my 3.1. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So that works. Now prevalence: The product is "code-projects Online Appointment Booking System 1.0", likely a small open-source project, not widely deployed. So prevalence "low". Prevalence basis: "niche open-source project with limited adoption". I'll write that. Exploitation conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Online Appointment Booking System 1.0." But wait: is it truly unauthenticated? The vector PR:N, so yes. I'll state that. However, I should check if the endpoint /admin/deletedoctor.php is directly accessible without login. The description does not explicitly say authentication required. So I'll go with PR:N. Exploitation conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Online Appointment Booking System 1.0." That is allowed. Attack chain: Recon → Access admin endpoint → Send malicious SQL via 'did' parameter → Trigger SQL injection → Extract/modify data in database. I'll condense into 5 steps: Recon → Send crafted HTTP request to /admin/deletedoctor.php with SQL payload in did → SQL injection executed → Exfiltrate or manipulate database → Impact. I'll write: "Send crafted HTTP request to /admin/deletedoctor.php → Inject SQL via did parameter → Execute SQL injection → Extract or modify sensitive data". That's 4 steps: Access (send request) → Exploit (inject SQL) → Execution (SQL injection) → Impact (extract/modify). Simplify: "Identify target system → Send crafted HTTP GET/POST with malicious 'did' parameter → SQL injection executed → Dump or alter database tables". I'll do 4-step: Access → Exploit → Execution → Impact. So: "Send crafted HTTP request to /admin/deletedoctor.php → Inject SQL payload via did parameter → Execute SQL injection → Exfiltrate sensitive information from database". That's fine. Remediation: No specific patch mentioned. The product appears to be a code-projects project, maybe no official patch. I'll suggest: "No vendor-released patch identified at time of analysis. As a workaround, restrict access to the /admin/ directory via .htaccess or web server configuration to trusted IPs, and consider rewriting the vulnerable SQL query with parameterized statements. If the system is not in production, disable the entire application." More precisely, "No patch available from the vendor; apply input validation and parameterized queries manually." I'll phrase: "No vendor patch available. Mitigations: disable the admin panel or restrict access to /admin/ to trusted IPs via web server configuration. Additionally, manually fix the SQL query in deletedoctor.php to use prepared statements. The system is unsupported; consider replacing it." I need a concise paragraph. Confidence notes: "CVE details from VulDB; exploit publicly available. No CISA KEV listing. Patch status unknown — no official fix from vendor. Remote unauthenticated access confirmed by CVSS 4.0 vector PR:N, but endpoint under /admin may imply authentication is required in some deployments; this is ambiguous." I'll mention that the CVSS says PR:N, but admin URL suggests auth, so there might be inconsistency. I'll state: "VulDB report claims unauthenticated remote access (PR:N), but /admin path suggests admin authentication may be required in some configurations. Vendor advisory missing. Confidence in impact limited due to sparse information." Good. Now product_name: "Online Appointment Booking System" - not too wordy. It's a single product. So "Online Appointment Booking System". I'll put that. Summary: I need a 2-3 sentence synthesis that doesn't copy description. Start with specific impact verb: "SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to manipulate database queries via the 'did' parameter in /admin/deletedoctor.php." Add exploitation status: "A public exploit is available, but exploitation probability is low (EPSS 0.07%)." Add who is affected: "Affected is version 1.0, no patch available." Summarize risk: "While CVSS 4.0 rates it medium, real-world risk is low due to limited deployment footprint and low exploitation probability." Technical context: "The vulnerability is an SQL injection in a PHP-based appointment booking application. The /admin/deletedoctor.php script takes a 'did' parameter and uses it directly in an SQL query without sanitization, allowing injection. CWE-74 indicates improper neutralization of special elements used in a downstream component. CPE shows the vendor is Anisha, product Online Appointment Booking System 1.0. PHP MySQL is the likely technology stack." I'll phrase. Risk assessment: Compare CVSS 4.0 score 5.5 (Medium), EPSS 0.07% (very low), no KEV, POC available, SSVC: exploitation available, automatable (AV:N, AC:L, AT:N), technical impact low (L/L/L). So risk is low despite public exploit. I'll say: "CVSS 4.0 base score 5.5 indicates medium severity with low impact on all CIA. EPSS probability of exploitation is only 0.07%, placing it in the 21st percentile — unlikely to be exploited in the wild. A public proof-of-concept exists, but no active exploitation reported. The product is a niche application, reducing mass exploitation risk. Overall, a low real-world priority." Affected products: "Online Appointment Booking System 1.0 (CPE: cpe:2.3:a:anisha:online_appointment_booking_system:1.0). Vendor site: https://code-projects.org/. No specific patched version exists. Affected file /admin/deletedoctor.php." I'll write a paragraph. Remediation paragraph: "No official patch is available. Isolate the admin interface by restricting access to /admin/ to trusted IP addresses via web server configuration (Apache: Require ip x.x.x.x). Manually edit deletedoctor.php to use parameterized queries with prepared statements. If the application is not essential, disable it entirely. Consider migrating to a maintained alternative." That's a good actionable guidance. Exploit scenario: "An unauthenticated attacker sends a crafted HTTP request to /admin/deletedoctor.php with a SQL payload in the 'did' parameter. Successful injection exfiltrates database contents, potentially exposing user credentials and appointment data. The publicly disclosed proof-of-concept facilitates exploitation." Not too long. Exploitation conditions: I already said above. So "No special conditions — remote unauthenticated exploitation against default configurations of Online Appointment Booking System 1.0." But maybe the admin page isn't exposed by default; the description says "attack may be launched remotely", so likely no special conditions. I'll add that if the admin interface is not internet-facing, risk is reduced. However, requirement is to state concrete conditions. I'll phrase: "Requires the /admin/deletedoctor.php endpoint to be exposed and reachable without authentication, which is the default configuration." I'll output that. Attack chain: As above: "Send crafted HTTP request to /admin/deletedoctor.php with SQL payload in 'did' parameter → SQL injection executes arbitrary SQL commands → Retrieve, modify, or delete data from the application database." Good. Confidence notes: I need to state confirmed/unknown. "Public exploit confirmed via GitHub. Vendor patch status unknown. Authentication requirements ambiguous—CVSS vector indicates unauthenticated (PR:N) but typical admin pages require login; this discrepancy is noted from NVD/exploit source. No official advisory from vendor exists." That covers it. Prevalence: "low" — niche product. basis: "small open-source project with minimal production use." Assessed CVSS 4.0 vector: I gave earlier, so
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote unauthenticated attackers to manipulate database queries via the cid parameter in /admin/addclinic.php. Public exploit code exists, but exploitation probability is low (EPSS 0.07%) and no active exploitation has been confirmed.
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the clinic parameter in /admin/addmanagerclinic.php. The vulnerability has a publicly available proof-of-concept exploit, though EPSS probability is low (0.07%) and it is not listed in CISA KEV, indicating limited active exploitation in the wild.
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'clinic' parameter in /admin/deletedoctorclinic.php. Attackers can potentially access, modify, or delete database contents. A public exploit is available, but no evidence of active exploitation has been published.
SQL injection in Online Appointment Booking System 1.0 allows remote attackers to manipulate the clinic parameter in /admin/adddoctorclinic.php, potentially extracting or modifying database data. The vulnerability has a publicly available exploit but no KEV listing, and EPSS suggests low exploitation probability.
SQL injection in the admin panel of Appointment Booking System 1.0 allows remote unauthenticated attackers to inject malicious SQL via the city parameter in /admin/getmanagerregion.php. Exploit code is publicly available, but no active exploitation is confirmed; EPSS predicts low exploitation probability (0.07%).
SQL injection in Online Appointment Booking System 1.0 enables remote attackers to execute arbitrary SQL commands via the Username parameter of the /admin/adddoctor.php endpoint. Public exploit code is available, though no active exploitation has been reported. The vulnerability could allow unauthorized database manipulation, potentially exposing patient data.
Heap buffer overflow in 7-Zip's RAR5 handler writes zeroes beyond allocated heap memory, causing memory corruption and denial of service in versions prior to 25.0.0. Local attackers can trigger this vulnerability by crafting malicious RAR5 archive files. Publicly available exploit code exists, making this a moderate-priority local vulnerability despite its network-isolated attack surface.
Reflected XSS in Beakon Learning Management System SCORM v5.4.3 allows an authenticated remote attacker to inject arbitrary JavaScript into a victim's browser session via the unsanitized `url` parameter of the SCORM loader endpoint. The PoC published on PacketStorm demonstrates direct cookie theft using a `javascript:alert(document.cookie)` payload, confirming the vulnerability is exploitable without specialized tooling. No patch has been identified at time of analysis; no public exploit identified at time of analysis beyond the published PoC, and EPSS at 0.25% (17th percentile) reflects low observed exploitation activity consistent with a niche product.