PHP CVE-2025-14207

We need to generate a JSON analysis for CVE-2025-14207. The input provides data: description, CVSS 4.0 vector, CWE, EPSS, tags, references, ENISA EUVD ID, affected versions, etc. No KEV data, so not actively exploited. The exploit is "publicly available". Patch info: rolling release, no version details, so no specific fix version.

I'll follow the instructions for each field.

product_name: The product is "Hotel-Management-System" by tushar-2223. It's a PHP-based system. So, "Hotel Management System" (1-3 words). Primary product. So "Hotel Management System".

summary: Need 2-3 sentences. Not paraphrasing description. Start with impact and product. It's SQL injection in Hotel-Management-System via invoiceprint.php's ID parameter. Remote exploitation possible. No KEV, EPSS low (0.04%). So: "SQL injection in tushar-2223 Hotel Management System allows remote attackers to manipulate database queries via the invoiceprint.php ID parameter." Mention EPSS and exploit: "Exploit code is publicly available, but EPSS indicates low exploitation probability (0.04%). No active exploitation confirmed." That's original synthesis.

technical_context: Underlying tech: PHP application, likely MySQL/MariaDB. SQL injection due to improper input validation. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), specifically SQL injection. CPE data not provided, but product is identified. So: "The vulnerability stems from insufficient input validation in a PHP script (/admin/invoiceprint.php). The ID parameter, likely used in a database query, can be manipulated to inject arbitrary SQL commands. This is the classic SQL injection scenario, where user-supplied data is concatenated into SQL without proper sanitization."

risk_assessment: CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's network, low complexity, no privileges, no user interaction, low impact on confidentiality, integrity, availability. EPSS 0.04%, low. No KEV. POC available. So overall: "CVSS 4.0 base score of 5.5 reflects low impact (VC/VI/VA all low), but the attack vector is network-accessible with no authentication, making exploitation easy. EPSS score (0.04%) suggests a very low probability of widespread exploitation. The availability of a public exploit slightly elevates risk for internet-facing instances, but the low impact limits urgency. With no active exploitation reported and a low EPSS, this is likely low-risk despite the easy exploitability." SSVC: exploitation status: PoC (public), automatable: yes (AV:N/AC:L), technical impact: partial (low). So decision: moderate priority? Not critical. I'll state: "Given the low impact and low EPSS, the real-world risk is low, though any SQL injection warrants attention."

affected_products: "tushar-2223 Hotel-Management-System (commit bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15 and earlier due to rolling release). No specific version numbers available." Reference vendor advisory? None from tushar-2223, just the vulnerability reports. I can include the references: GitHub report and VulDB links. So: "The vulnerability affects the Hotel-Management-System by tushar-2223, particularly the commit referenced above. Due to the project's rolling release model, there are no designated version numbers. The advisory on VulDB (ID 334650) and a detailed report on GitHub provide technical details."

remediation: No official patch. Rolling release, fix not confirmed. So remediation: "No vendor-released patch is available at this time. The project uses continuous delivery, so the maintainer may have already fixed the issue in later commits, but this is unconfirmed. As a workaround, restrict access to the /admin/invoiceprint.php endpoint to authorized personnel only, for example by IP whitelisting or requiring additional authentication. Consider applying input validation on the ID parameter to allow only numeric values, though this may break functionality if not done carefully. Monitor the GitHub repository for a confirmed fix."

exploit_scenario: "An attacker sends a crafted HTTP request to /admin/invoiceprint.php with a malicious ID parameter containing SQL injection payload. If the application is exposed and no authentication is required, the database can be read or manipulated, potentially leaking sensitive information like guest records or admin credentials." POC exists, so note that.

exploitation_conditions: Specific conditions: The attack requires the /admin/invoiceprint.php endpoint to be accessible. The CVSS vector indicates PR:N, so no authentication, but the endpoint is under /admin/; typical admin panels often require authentication. However, the description and CVSS explicitly state PR:N, so I'll trust that. So: "No authentication required (PR:N per CVSS). The invoiceprint.php script must be reachable over the network; if the application is behind authentication, exploitation is limited to authenticated users. The SQL injection occurs via the ID parameter, so the attacker must be able to supply arbitrary strings to that parameter." The EPSS low might be because admin panels are often restricted. But I'll state: "The primary condition is that the vulnerable endpoint /admin/invoiceprint.php is exposed without authentication. If the application enforces admin login, then exploitation requires valid credentials, contrary to the CVSS assumption. However, the public exploit may bypass authentication or the default installation may not enforce it."

attack_chain: Steps: Access vulnerable endpoint → Inject SQL payload via ID parameter → Execute unauthorized SQL commands → Extract or modify data. Since PR:N, no auth step. So chain: "Access /admin/invoiceprint.php remotely → Inject crafted SQL string in ID parameter → Database executes malicious query → Exfiltrate sensitive data from hotel management database." Fits kill chain: Access → Delivery → Exploit → Execution → Exfiltration (impact). So: "Send HTTP request to /admin/invoiceprint.php → Inject SQL payload in ID parameter → Database executes arbitrary SQL query → Retrieve guest records or credentials."

confidence_notes: "NVD and VulDB confirm the vulnerability and public exploit availability. EPSS data from FIRST.org. No vendor advisory from the project maintainer; the fix status is unknown due to rolling release. The CVSS 4.0 score is from VulDB/NVD and seems consistent. The PR:N in CVSS is questionable given the /admin/ path, but the vector is authoritative per the source." So I'll state: "Exploit confirmed publicly available. Patch status unconfirmed due to rolling release; no specific version. CVSS 4.0 vector accepted as authoritative, though the PR:N assumption for an admin path may not hold in all deployments."

prevalence: The product is a niche Hotel Management System by an individual developer on GitHub. It's not widely deployed; likely used in small projects or learning exercises. So "low". Justification: "niche open-source hotel management project with limited production use".

prevalence_basis: "Niche open-source project, minimal enterprise footprint"

assessed_cvss_vector: I need to independently assess CVSS 3.1. Based on description: remote, no auth (PR:N), no user interaction, low impact on confidentiality, integrity, availability? The CVSS 4.0 has VC:L/VI:L/VA:L. For 3.1, it's a SQL injection, so confidentiality, integrity might be high if full DB access, but the score says low. I'll follow the impact as given: low. So: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's a 3.1 vector. But is scope changed? Probably unchanged because it's just the web app. So: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L". That yields score 7.3? That's high. Wait, calculate: C:L, I:L, A:L = (conf 3.4, integ 3.4, avail 2.8) with S:U, total: 9.6? Actually base score formula: Attack Vector: Network (0.85), Attack Complexity: Low (0.77), Privileges Required: None (0.85), User Interaction: None (0.85), Scope: Unchanged. Impact: C:L (0.22), I:L (0.22), A:L (0.22) => ISS = 1 - (1-0.22)*(1-0.22)*(1-0.22) = 0.506, adjusted: since scope unchanged, impact = 6.42*ISS = 3.25. Exploitability = 8.22*0.85*0.77*0.85 = 4.57. Base score = min(10, roundup(3.25+4.57)) = 7.8? Actually 7.8? Wait, roundup(7.82) = 7.8? Actually roundup(7.82) is 7.9. Something's off. Let's recalc: ISS = 1 - (1-0.22)^3 = 1 - 0.78^3 = 1 - 0.475 = 0.525. then impact = 6.42 * ISS = 6.42*0.525 = 3.37. Exploitability = 8.22 * AV:N * AC:L * PR:N * UI:N = 8.22 * 0.85 * 0.77 * 0.85 * 0.85 = 8.22 * (0.85*0.77*0.85*0.85) = 8.22 * 0.472 = 3.88. Base = 3.37 + 3.88 = 7.25, roundup = 7.3. So score 7.3. The CVSS 4.0 gave 5.5, which is low. But if I use C:L/I:L/A:L, 3.1 gives 7.3. That's a discrepancy. Maybe the impact should be low? But SQL injection typically gives high confidentiality if you can read all data. However, the assigned C/I/A low in CVSS 4.0 suggests limited impact, perhaps only error-based or blind, not full dump. I'll trust the source's impact: low. So 7.3. That's High, not low. But the risk assessment had low risk. I should stick with the source's impact assessment: VC:L, etc. So my 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. I'll output that. But the CVSS score for that is 7.3 (High). That contrasts with the CVSS 4.0 score 5.5 (Medium). I can note the inconsistency. But as analyst, I'm to provide my own independent assessment. If I believe the impact is low, 7.3 is still high. But I might adjust if I think SQL injection always leads to high impact. However, the instructions: "Your OWN independent CVSS 3.1 base-metric vector for THIS vulnerability, grounded in the description and exploitation conditions — NOT a copy of any score in the input." I need to interpret impact based on description. The description only says SQL injection, no specifics on impact. With SQL injection, typically you can read entire database, so C:H, I:H, A maybe L (if you can modify data). But the input source gave low, so maybe it's just error-based without useful output. I'll consider that the assessment is that the impact is limited, perhaps only error information leakage, not full data exfiltration. So I'll stick with low. But I can mention in rationale that I'm assuming low impact based on researcher's assessment, though typical SQLi could lead to higher impact. So rating as Low. So vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's a 7.3 High base score, but I'll note that the actual impact might be higher. I'll include it and then explain.

assessed_cvss_rationale: "Network-exploitable with no authentication; impact limited to low based on the researcher's assessment, but typical SQLi may have higher impact."

assessed_cvss40_vector: The provided vector already exists: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N ... I'll output that same base vector (the base part) as my assessment, consistent with my 3.1. So: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA