Refugee Food Management System
CVE-2025-15185
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote network access, no privileges or user interaction required, low impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in code-projects Refugee Food Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /home/refugeesreport.php. This manipulation of the argument a causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
AnalysisAI
SQL injection in code-projects Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'a' parameter in /home/refugeesreport.php. A publicly available proof-of-concept exploit exists, but the vulnerability has not been actively exploited according to CISA KEV. EPSS score is low (0.04%), suggesting limited exploitation risk.
Technical ContextAI
The vulnerability is a classic SQL injection (CWE-74) in a PHP-based web application. The parameter 'a' in the /home/refugeesreport.php endpoint is directly concatenated into SQL queries without proper sanitization or parameterization. The application uses PHP with likely a MySQL backend. The CPE indicates the exact product version is 1.0.
RemediationAI
No vendor-released patch identified at time of analysis. As a compensating control, implement input validation and parameterized queries for all user-supplied parameters, especially the 'a' parameter in /home/refugeesreport.php. Additionally, restrict network access to the application if possible, and use a web application firewall (WAF) to block SQL injection patterns. The recommended long-term fix is to upgrade to a patched version if released. Note that blocking the endpoint may break legitimate functionality.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today