EUVD-2025-20767Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify target running LifeStyle Store
-
ExploitSend crafted HTTP request to /cart_add.php with SQL payload in ID parameter
-
ExecutionBackend database executes malicious query
-
ImpactAttacker retrieves or alters database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation is possible against the default installation of LifeStyle Store 1.0, provided the /cart_add.php endpoint is accessible over the network. The CVSS vector indicates PR:N (no privileges required) and UI:N (no user interaction needed). |
| Impact | CVSS 4.0 base score is 5.5 (medium), with a vector of AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L, indicating low impact on confidentiality, integrity, and availability. Despite being remotely exploitable with no privileges, the real-world risk is low: EPSS score is 0.05% (14th percentile), and there is no CISA KEV listing. Public exploit code exists but active exploitation has not been confirmed. The product is a small, presumably unmaintained PHP store with likely minimal deployment footprint, further reducing the urgency. The description labels this 'critical,' but the low impact metrics contradict that severity claim. |
| Exploit ScenarioDerived | An unauthenticated attacker sends an HTTP request to /cart_add.php containing a malicious SQL payload in the ID parameter. The payload manipulates the database query, potentially exposing customer data or modifying records. A proof-of-concept exploit is publicly available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
SQL injection in LifeStyle Store 1.0 allows remote attackers to manipulate database queries via the ID parameter of /cart_add.php. The vulnerability has a publicly available exploit, but no active exploitation has been reported; EPSS predicts very low exploitation probability (0.05%).
Earlier versions of this analysis (1)
RemediationAI
No official patch is available from the vendor. As an immediate workaround, restrict access to the /cart_add.php script (e.g., via web server rules or .htaccess) or apply input validation to the ID parameter. Given the project appears unmaintained, consider replacing the application. If continued use is necessary, implement a web application firewall rule to block SQL injection attempts targeting this endpoint.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in a PHP application, indicated by the CPE product 'lifestyle_store' from vendor 'anisha'. The root cause is improper neutralization of special elements (CWE-74), typical of SQL injection, in the /cart_add.php script where user-supplied ID parameter is directly incorporated into an SQL query without sanitization.
Know when Lifestyle Store gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-exploitable SQL injection with no privileges; limited to individual query manipulation without scope change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in code-projects LifeStyle Store 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /cart_add.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Organizations using A vulnerability face moderate risk from CVE-2025-7211, a injection vulnerability rated CVSS 7.3. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. Proof-of-concept code is publicly available, increasing the risk of exploitation. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Lifestyle Store
View allCVE-2025-7411 is a critical SQL injection vulnerability in code-projects LifeStyle Store 1.0 affecting the /success.php
CVE-2025-7410 is a critical SQL injection vulnerability in code-projects LifeStyle Store version 1.0, affecting the /car
Exploit-DB