Which versions of PHP are affected by CVE-2025-5709?

A publicly disclosed SQL injection vulnerability in the Real Estate Property Management System allows remote attackers to potentially access, modify, or delete sensitive property and customer data…

Is there a public PoC exploit available for CVE-2025-5709?

Yes, a public proof-of-concept exploit is available for CVE-2025-5709. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5709?

Within 24 hours: Isolate affected systems from production networks or restrict access to trusted users only; implement WAF rules to block malicious SQL injection payloads targeting /Admin/InsertCategory.php; review access logs for exploitation attempts. Within 7 days: Conduct forensic analysis to determine if the system has been compromised; audit all database changes and user access during the vulnerability exposure window. Within 30 days: Evaluate alternative vendor solutions or request emergency patching timeline from vendor; if no patch is forthcoming, plan system decommissioning or replacement.

PHP CVE-2025-5709

Q: What is the CVSS score of CVE-2025-5709?

CVE-2025-5709 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-17043 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-06 cna@vuldb.com

PHP SQLi Real Estate Property Management System Fabian

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17043

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

PoC Detected

Oct 23, 2025 - 20:06 vuln.today

Public exploit code

CVE Published

Jun 06, 2025 - 02:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability classified as critical was found in code-projects Real Estate Property Management System 1.0. This vulnerability affects unknown code of the file /Admin/InsertCategory.php. The manipulation of the argument txtCategoryName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical SQL injection vulnerability in code-projects Real Estate Property Management System version 1.0 affecting the /Admin/InsertCategory.php endpoint. An unauthenticated remote attacker can manipulate the txtCategoryName parameter to execute arbitrary SQL commands, potentially compromising database confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, making active exploitation a significant risk.

Technical ContextAI

This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), specifically manifesting as SQL injection. The root cause stems from insufficient input validation and sanitization of user-supplied data (txtCategoryName) before it is incorporated into SQL queries within the /Admin/InsertCategory.php file. The Real Estate Property Management System processes category insertion operations through this PHP endpoint without implementing parameterized queries, prepared statements, or proper escaping mechanisms. This allows attackers to break out of intended SQL syntax and inject malicious SQL commands that execute with the application's database privileges. The vulnerable component is a web-based administrative interface handling data insertion operations, typical of PHP-based management systems lacking modern secure coding practices.

RemediationAI

Immediate remediation steps: (1) Apply available security patches from code-projects for Real Estate Property Management System—contact vendor directly if patches are not yet publicly available; (2) If patches are unavailable, implement temporary mitigations: restrict access to /Admin/InsertCategory.php via network firewall rules or WAF rules blocking access except from trusted administrative networks; (3) Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the txtCategoryName parameter (detect quotes, SQL keywords, comment sequences); (4) Code-level remediation (if vendor patch is delayed): Replace all dynamic SQL queries with parameterized prepared statements using PHP PDO or mysqli with bound parameters; validate and sanitize txtCategoryName input using strict whitelisting (alphanumeric + underscore only); apply proper output encoding. (5) Conduct database activity monitoring and review logs for evidence of exploitation attempts. (6) Perform security testing post-remediation using OWASP ZAP or similar tools to verify SQL injection vulnerabilities are eliminated.