Is there a public PoC exploit available for CVE-2025-11605?

Yes, a public proof-of-concept exploit is available for CVE-2025-11605. Prioritise patching immediately. EPSS: 0.0%.

Client Details System CVE-2025-11605

Q: What is the CVSS score of CVE-2025-11605?

CVE-2025-11605 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-11 cna@vuldb.com

PHP SQLi Client Details System Fabian

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:16 vuln.today

DescriptionCVE.org

A vulnerability was identified in code-projects Client Details System 1.0. Impacted is an unknown function of the file /admin/update-profile.php. Such manipulation of the argument uid leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in code-projects Client Details System 1.0 allows authenticated remote attackers to manipulate the uid parameter in /admin/update-profile.php, enabling arbitrary database queries with limited confidentiality and integrity impact. Publicly available exploit code exists; however, the EPSS score of 0.04% and CVSS 2.1 severity indicate low real-world exploitation probability despite low barriers to attack (network-accessible, low complexity, no user interaction required).

Technical ContextAI

The vulnerability involves improper input validation and parameterization in the uid parameter of the /admin/update-profile.php endpoint, classified as Improper Neutralization of Special Elements used in an SQL Command (CWE-74). The affected product is a PHP-based client management system (CPE: cpe:2.3:a:fabian:client_details_system:1.0:*:*:*:*:*:*:*) that fails to sanitize or use prepared statements for user-supplied input before constructing SQL queries. This is a classic SQL injection flaw in server-side database interaction logic.

RemediationAI

No vendor-released patch identified at time of analysis. Immediate mitigation requires code modification: (1) Replace all dynamic SQL query construction in /admin/update-profile.php with parameterized prepared statements using PHP PDO or mysqli prepared statement APIs, ensuring the uid parameter is bound as a parameter rather than concatenated into the query string; (2) Implement strict input validation to reject uid values that do not match expected format (e.g., numeric-only if uid is an integer); (3) Apply principle of least privilege to the database user account used by the application, restricting it to SELECT and UPDATE operations on specific tables only, not DROP or administrative commands. Additionally, restrict access to /admin/* paths to authorized administrators only via web server access controls (IP whitelisting, authentication gateway). For organizations unable to modify source code immediately, disable the profile update feature or restrict administrative interface access to trusted networks.