Is there a public PoC exploit available for CVE-2025-7193?

Yes, a public proof-of-concept exploit is available for CVE-2025-7193. Prioritise patching immediately. EPSS: 0.0%.

Agri-Trading Online Shopping System CVE-2025-7193

Q: What is the CVSS score of CVE-2025-7193?

CVE-2025-7193 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-20688 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-08 cna@vuldb.com

PHP SQLi Agri Trading Online Shopping System Adonesevangelista

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Remote unauthenticated attack with no user interaction and limited impact on confidentiality, integrity, and availability.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 04:21 euvd

EUVD-2025-20688

Analysis Generated

Mar 16, 2026 - 04:21 vuln.today

PoC Detected

Jul 11, 2025 - 18:44 vuln.today

Public exploit code

CVE Published

Jul 08, 2025 - 20:15 cve.org

MEDIUM 5.5

CVE Published

Jul 08, 2025 - 20:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in itsourcecode Agri-Trading Online Shopping System up to 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/suppliercontroller.php. The manipulation of the argument supplier leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in itsourcecode Agri-Trading Online Shopping System 1.0 allows remote, unauthenticated attackers to execute arbitrary SQL commands via the 'supplier' parameter in /admin/suppliercontroller.php. Exploit code is publicly available, but no evidence of active exploitation. The vulnerability carries a CVSS 4.0 base score of 5.5 (Medium) with limited impact on confidentiality, integrity, and availability.

Technical ContextAI

The flaw exists in a PHP file /admin/suppliercontroller.php that fails to properly sanitize user-supplied input before constructing SQL queries. The underlying technology is a custom PHP e-commerce platform; the root cause aligns with CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), a parent class of SQL injection. According to CPE cpe:2.3:a:adonesevangelista:agri-trading_online_shopping_system:*:*:*:*:*:*:*:*, all versions up to and including 1.0 are affected, with the vulnerability residing in an unspecified function that handles the 'supplier' parameter directly in database calls.

RemediationAI

No vendor-released patch has been identified at the time of this analysis. The open-source nature of the project suggests that community updates may emerge. As immediate compensating controls, consider disabling or restricting access to /admin/suppliercontroller.php if not essential-this may break admin supplier-management functionality. Deploying a Web Application Firewall (WAF) rule to block SQL injection attempts on the 'supplier' parameter can mitigate attacks with minimal false positives. For a code-level fix, developers should implement parameterized queries or rigorous input validation for the 'supplier' parameter, but note that such changes require re-deployment of the application. Monitor the VulDB entry and GitHub issue for any official patches.