Which versions of PHP are affected by CVE-2025-41008?

Organizations using SQL injection vulnerability in Sinturno. This vulnerability face critical risk from CVE-2025-41008, a SQL injection vulnerability rated CVSS 9.3.

How to fix or mitigate CVE-2025-41008?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

PHP CVE-2025-41008

Q: What is the CVSS score of CVE-2025-41008?

CVE-2025-41008 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-208935 CRITICAL

SQL Injection (CWE-89)

2026-03-23 INCIBE

GHSA-8wgh-35g5-cg6v

PHP SQLi

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 13:30 euvd

EUVD-2025-208935

Analysis Generated

Mar 23, 2026 - 13:30 vuln.today

CVE Published

Mar 23, 2026 - 12:59 nvd

CRITICAL 9.3

DescriptionCVE.org

SQL injection vulnerability in Sinturno. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'client' parameter in the '/_adm/scripts/modalReport_data.php' endpoint.

AnalysisAI

A SQL injection vulnerability exists in Sinturno that allows unauthenticated or low-privileged attackers to execute arbitrary SQL commands through the 'client' parameter in the '/_adm/scripts/modalReport_data.php' endpoint. This vulnerability enables complete database compromise including retrieval, creation, updating, and deletion of database objects. The vulnerability was reported by INCIBE and affects all versions of Sinturno; no CVSS score, EPSS data, or KEV status has been published, but the ability to perform CRUD operations on databases represents critical severity regardless of formal scoring.

Technical ContextAI

Sinturno is a PHP-based application identified via CPE (cpe:2.3:a:sinturno:sinturno:*:*:*:*:*:*:*:*), and this vulnerability represents a classic SQL injection flaw classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The 'client' parameter in the '/_adm/scripts/modalReport_data.php' endpoint fails to properly sanitize or parameterize user input before incorporating it into SQL queries. This PHP application likely uses direct string concatenation or inadequate prepared statement implementation when constructing SQL commands, allowing attackers to break out of the intended query context and inject malicious SQL syntax.

RemediationAI

Immediately contact Sinturno vendors or maintainers for security patches addressing SQL injection in the modalReport_data.php endpoint; apply patches to all instances as they become available. Until patches are deployed, implement immediate mitigations: enforce strict input validation and parameterized queries (prepared statements) for the 'client' parameter and all user-supplied inputs in the affected endpoint; deploy Web Application Firewall (WAF) rules to block SQL injection syntax in HTTP requests; restrict network access to the '/_adm/' administrative path to trusted IP ranges only; and conduct a full database audit for signs of unauthorized access or data exfiltration. Refer to INCIBE's advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-sinturno for official patch release information.