Is there a public PoC exploit available for CVE-2025-15209?

Yes, a public proof-of-concept exploit is available for CVE-2025-15209. Prioritise patching immediately. EPSS: 0.1%.

Refugee Food Management System CVE-2025-15209

Q: What is the CVSS score of CVE-2025-15209?

CVE-2025-15209 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-29 cna@vuldb.com

PHP SQLi Refugee Food Management System Fabian

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:45 vuln.today

DescriptionCVE.org

A weakness has been identified in code-projects Refugee Food Management System 1.0. This affects an unknown part of the file /home/editfood.php. This manipulation of the argument a/b/c/d causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.

AnalysisAI

SQL injection in Refugee Food Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via manipulated a/b/c/d arguments in /home/editfood.php, affecting confidentiality and integrity of stored data. The vulnerability has a public exploit available but carries low real-world risk due to authentication requirement and minimal scope (CVSS 2.1, EPSS 0.05%). Active exploitation is not confirmed in CISA KEV despite public POC availability.

Technical ContextAI

The vulnerability exists in the PHP application's handling of user-supplied input through the a/b/c/d URL parameters passed to /home/editfood.php without proper SQL parameterization or input sanitization. This is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), a weakness in output encoding that allows SQL commands to be injected into database queries. The affected product is identified by CPE cpe:2.3:a:fabian:refugee_food_management_system:1.0. The narrow impact scope (VC:L/VI:L/VA:L) indicates the vulnerability is constrained to limited confidentiality and integrity impact with no availability effect, suggesting the injection occurs in a specific query context rather than allowing full database compromise.

RemediationAI

No vendor-released patch has been identified at time of analysis. Immediate mitigation requires upgrading from version 1.0 to a patched release if available from Code-Projects; verify patch status at https://code-projects.org/. Compensating controls pending patching include: (1) restrict network access to /home/editfood.php to trusted internal networks via web application firewall or reverse proxy, (2) implement web application firewall (WAF) rules to block SQL injection patterns in the a/b/c/d parameters (blocks character sequences like UNION, SELECT, OR 1=1), (3) enforce database user accounts with minimal privileges (read-only where possible) to limit SQL injection impact scope. Each control has trade-offs: network restriction may impact legitimate remote access; WAF rules may require tuning to avoid false positives on legitimate data patterns. Urgent action is not required due to low EPSS (0.05%), but patching should be scheduled as part of regular application maintenance cycles.