Which versions of PHP are affected by CVE-2025-5711?

A critical SQL injection vulnerability in the Real Estate Property Management System allows attackers to remotely compromise the database and extract sensitive property and customer information.

Is there a public PoC exploit available for CVE-2025-5711?

Yes, a public proof-of-concept exploit is available for CVE-2025-5711. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5711?

Within 24 hours: Take the Admin/InsertCity.php component offline or restrict access to trusted administrative networks only; alert all system users to change database credentials. Within 7 days: Deploy WAF rules to block SQL injection patterns targeting the cmbState parameter; implement comprehensive database access logging and monitoring. Within 30 days: Contact the vendor for patch availability; evaluate migration to a patched version or alternative system; conduct full database audit for unauthorized access or data exfiltration.

PHP CVE-2025-5711

Q: What is the CVSS score of CVE-2025-5711?

CVE-2025-5711 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-17041 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-06 cna@vuldb.com

PHP SQLi Real Estate Property Management System Fabian

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17041

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

PoC Detected

Oct 23, 2025 - 20:06 vuln.today

Public exploit code

CVE Published

Jun 06, 2025 - 03:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability, which was classified as critical, was found in code-projects Real Estate Property Management System 1.0. Affected is an unknown function of the file /Admin/InsertCity.php. The manipulation of the argument cmbState leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical SQL injection vulnerability in code-projects Real Estate Property Management System 1.0, specifically in the /Admin/InsertCity.php file's cmbState parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, making active exploitation likely.

Technical ContextAI

This vulnerability stems from improper input validation and parameterization in PHP code handling database queries (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component). The affected file /Admin/InsertCity.php processes the cmbState parameter without proper SQL escaping or prepared statements, allowing SQL metacharacters to be injected directly into database queries. The Real Estate Property Management System is a web-based application that likely uses PHP with a backend database (MySQL/MariaDB), and the vulnerable endpoint is accessible to unauthenticated users based on the CVSS vector indicating no privilege requirements (PR:N).

RemediationAI

Immediate remediation steps: (1) Update to a patched version if available from code-projects; (2) Apply input validation: implement whitelist validation for cmbState parameter to accept only valid state identifiers; (3) Use prepared statements/parameterized queries for all database interactions in InsertCity.php; (4) Implement output encoding for database queries; (5) Apply principle of least privilege to database credentials used by the application. Workarounds if patch unavailable: (a) Disable or restrict access to /Admin/InsertCity.php at the web server level (nginx/Apache); (b) Implement Web Application Firewall (WAF) rules to block SQL injection patterns in the cmbState parameter; (c) Apply strict input validation regex patterns before query execution. Recommended: Contact code-projects for security updates or migrate to maintained alternatives.