What is the CVSS score of CVE-2025-5435?

CVE-2025-5435 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2025-5435?

A critical SQL injection vulnerability in Marwal Infotech CMS 1.0 allows remote attackers to compromise database integrity and confidentiality without authentication.

How to fix or mitigate CVE-2025-5435?

Within 24 hours: Identify all systems running Marwal Infotech CMS 1.0 and assess their internet exposure; implement emergency WAF rules to block malicious SQL payloads targeting /page.php ID parameter. Within 7 days: Isolate vulnerable CMS instances from production networks or disable the /page.php endpoint if non-critical; conduct forensic review of access logs for exploitation attempts. Within 30 days: Evaluate migration to alternative CMS solutions with active vendor support; establish vendor communication protocol to track patch availability.

PHP CVE-2025-5435

EUVD-2025-16623 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-02 cna@vuldb.com

PHP SQLi

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 16:47 euvd

EUVD-2025-16623

Analysis Generated

Mar 14, 2026 - 16:47 vuln.today

CVE Published

Jun 02, 2025 - 08:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in Marwal Infotech CMS 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /page.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Critical SQL injection vulnerability in Marwal Infotech CMS 1.0 affecting the /page.php file's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially extract, modify, or delete database contents. The vulnerability has public exploit disclosure and proof-of-concept availability, but the vendor has not responded to early disclosure notifications, leaving affected deployments unpatched and at active risk.

Technical ContextAI

This vulnerability stems from improper input validation and parameterization in the /page.php endpoint, classified under CWE-74 (Improper Neutralization of Special Elements in Output, 'Injection'). The ID parameter accepts unsanitized user input that is directly incorporated into SQL queries without prepared statements or parameterized query mechanisms. Marwal Infotech CMS 1.0 is a PHP-based content management system; the vulnerability exists in the page retrieval logic where ID-based lookups likely construct dynamic SQL strings. The root cause reflects a fundamental failure to implement proper output encoding and query parameterization, allowing attackers to manipulate SQL syntax and inject arbitrary commands into the database query execution context.

RemediationAI

Immediate remediation options are severely constrained due to vendor non-responsiveness: (1) UPGRADE/REPLACE: Migrate away from Marwal Infotech CMS 1.0 to an actively maintained alternative CMS (WordPress, Drupal, Joomla with current patches); (2) WORKAROUND (temporary): Implement Web Application Firewall (WAF) rules blocking SQL injection payloads in the ID parameter (monitor for UNION, SELECT, DROP, INSERT in parameter values; use regex patterns for common SQL injection syntax); (3) INPUT VALIDATION (emergency patch): If source code access exists, immediately implement parameterized queries or prepared statements for all page.php database operations—replace dynamic SQL with bound parameters; (4) NETWORK ISOLATION: Restrict /page.php access via IP allowlisting or authentication layer; (5) DATABASE HARDENING: Apply principle of least privilege to database user accounts (read-only access where possible); enable SQL query logging and monitoring for anomalous activity. No official vendor patch is expected given non-responsiveness.