EUVD-2025-18440Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low privileges required, no user interaction, low impact across all three security properties.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was found in Projectworlds Life Insurance Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /insertagent.php. The manipulation of the argument agent_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
SQL injection in Projectworlds Life Insurance Management System 1.0 via the agent_id parameter in /insertagent.php allows authenticated remote attackers to manipulate database queries. Public exploit code is available, but no active exploitation has been confirmed. The vulnerability has low impact (C:L/I:L/A:L) and a very low EPSS score (0.06%), suggesting limited real-world risk.
Technical ContextAI
The vulnerability is a SQL injection (CWE-89) in a PHP-based web application. The affected endpoint, /insertagent.php, uses the agent_id parameter in a database query without proper sanitization or parameterization. Attackers can inject malicious SQL statements, potentially reading, modifying, or deleting data. The product is packaged as a single version 1.0, identified by CPE cpe:2.3:a:projectworlds:life_insurance_management_system:1.0.
RemediationAI
No vendor-released patch is available at this time. As a temporary mitigation, restrict network access to the /insertagent.php endpoint to trusted IPs or disable the agent insertion feature entirely if it is not business-critical. Employing a web application firewall (WAF) with SQL injection protections and applying strict input validation to the agent_id parameter can reduce exposure. The definitive fix is to refactor the PHP code to use prepared statements with parameter binding. Note that disabling /insertagent.php may break agent creation workflows.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today