What is the CVSS score of CVE-2025-34102?

CVE-2025-34102 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 60.0%.

Which versions of PHP are affected by CVE-2025-34102?

A critical remote code execution vulnerability (CVE-2025-34102) affecting the discontinued PHP version of CryptoLog allows unauthenticated attackers to gain complete shell access to web servers…

Is there a public PoC exploit available for CVE-2025-34102?

Yes, a public proof-of-concept exploit is available for CVE-2025-34102. Prioritise patching immediately. EPSS: 60.0%.

How to fix or mitigate CVE-2025-34102?

Within 24 hours: Identify and inventory all systems running CryptoLog PHP version; immediately isolate affected servers from production networks if possible; enable enhanced monitoring for suspicious login and command execution attempts. Within 7 days: Decommission CryptoLog PHP instances or migrate to the ASP.NET version (confirmed unaffected); if immediate migration is infeasible, implement strict network access controls limiting CryptoLog access to trusted internal IPs only. Within 30 days: Complete removal of all CryptoLog PHP installations; conduct forensic analysis of affected systems for evidence of compromise given the public exploit availability and 60% EPSS score.

PHP CVE-2025-34102

EUVD-2025-21029 CRITICAL

Improper Input Validation (CWE-20)

2025-07-10 disclosure@vulncheck.com

PHP RCE Command Injection SQLi Authentication Bypass

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 06:52 euvd

EUVD-2025-21029

Analysis Generated

Mar 16, 2026 - 06:52 vuln.today

PoC Detected

Jul 15, 2025 - 13:14 vuln.today

Public exploit code

CVE Published

Jul 10, 2025 - 20:15 nvd

CRITICAL 9.3

DescriptionCVE.org

A remote code execution vulnerability exists in CryptoLog (PHP version, discontinued since 2009) due to a chained exploitation of SQL injection and command injection vulnerabilities. An unauthenticated attacker can gain shell access as the web server user by first exploiting a SQL injection flaw in login.php to bypass authentication, followed by command injection in logshares_ajax.php to execute arbitrary operating system commands.

The login bypass is achieved by submitting crafted SQL via the user POST parameter. Once authenticated, the attacker can abuse the lsid POST parameter in the logshares_ajax.php endpoint to inject and execute a command using $(...) syntax, resulting in code execution under the web context.

This exploitation path does not exist in the ASP.NET version of CryptoLog released since 2009.

AnalysisAI

CryptoLog PHP edition (discontinued since 2009) contains a chained SQL injection and command injection vulnerability. An unauthenticated attacker can first bypass authentication via SQLi in login.php, then exploit command injection to gain shell access as the web server user.

Technical ContextAI

The login.php script is vulnerable to SQL injection allowing authentication bypass. Once authenticated, additional endpoints contain command injection vulnerabilities that execute OS commands. The chain provides unauthenticated RCE on systems running this discontinued application.