Refugee Food Management System
CVE-2025-15185
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify vulnerable endpoint
-
DeliveryCraft SQLi payload
-
ExploitSend HTTP GET request
-
ExecutionExecute malicious SQL
-
ImpactImpact data extraction or modification
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Refugee Food Management System 1.0. The vulnerable parameter 'a' is not behind authentication. The attack does not require any specific configuration or user interaction. Limits: The application must be running and accessible over the network; no other prerequisites. |
| Impact | CVSS 4.0 vector indicates network-exploitable, low complexity, no privileges, no user interaction, impacting confidentiality, integrity, and availability at low level. With a public proof-of-concept exploit, the threshold for attack is low. However, the EPSS score is very low (0.04%, 11th percentile), suggesting that despite exploit availability, active exploitation in the wild is unlikely. The application appears to be a small-scale project (code-projects.org) with limited deployment, reducing real-world risk. There is no CISA KEV listing. Overall, this is a high-CVSS but low-real-risk issue due to limited adoption and low exploitation prevalence. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP GET request to /home/refugeesreport.php with a malicious SQL payload in the 'a' parameter. The application concatenates this into a SQL query, allowing the attacker to extract sensitive data (e.g., refugees' personal information) or modify database contents. A publicly available exploit script demonstrates the exact payload. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
SQL injection in code-projects Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'a' parameter in /home/refugeesreport.php. A publicly available proof-of-concept exploit exists, but the vulnerability has not been actively exploited according to CISA KEV. EPSS score is low (0.04%), suggesting limited exploitation risk.
RemediationAI
No vendor-released patch identified at time of analysis. As a compensating control, implement input validation and parameterized queries for all user-supplied parameters, especially the 'a' parameter in /home/refugeesreport.php. Additionally, restrict network access to the application if possible, and use a web application firewall (WAF) to block SQL injection patterns. The recommended long-term fix is to upgrade to a patched version if released. Note that blocking the endpoint may break legitimate functionality.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic SQL injection (CWE-74) in a PHP-based web application. The parameter 'a' in the /home/refugeesreport.php endpoint is directly concatenated into SQL queries without proper sanitization or parameterization. The application uses PHP with likely a MySQL backend. The CPE indicates the exact product version is 1.0.
Know when Refugee Food Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote network access, no privileges or user interaction required, low impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A flaw has been found in code-projects Refugee Food Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /home/refugeesreport.php. This manipulation of the argument a causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
SQL injection in Refugee Food Management System 1.0 allows remote attackers to manipulate the backend database via the '
We are tasked with creating a comprehensive JSON analysis for CVE-2025-15181, synthesizing all input data. The data incl
SQL injection in Refugee Food Management System 1.0 allows remote attackers to inject arbitrary SQL via the 'a' paramete
Remote SQL injection in code-projects Refugee Food Management System 1.0 allows unauthenticated attackers to execute arb
SQL injection in code-projects Refugee Food Management System 1.0 allows remote attackers to inject arbitrary SQL via th
SQL injection in Refugee Food Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queri
SQL injection in Refugee Food Management System 1.0 allows authenticated remote attackers to manipulate refNo, Fname, Ln
SQL injection in Refugee Food Management System 1.0 (/home/editrefugee.php) allows authenticated remote attackers to man
SQL injection in Refugee Food Management System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL com
SQL injection in the Refugee Food Management System 1.0 allows unauthenticated attackers to extract or modify database c
SQL injection in Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queri
Exploit-DB