PHP CVE-2025-7217

We need to produce a JSON with all specified fields. The input: CVE-2025-7217, description, etc. We'll synthesize from multiple sources. Note: CVSS provided is only CVSS 4.0 vector. No KEV status (so no KEV, it's not in KEV list). EPSS 0.05% (low), POC publicly available. Tags: SQLi, PHP, Payroll Management System. Product: Campcodes Payroll Management System 1.0. File: /ajax.php?action=save_position, parameter ID -> SQL injection. Classification: critical. Exploit disclosed. References: GitHub issue (exploit), VulDB entries, etc.

Need fields: product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector.

Let's go field by field:

1. product_name: "Payroll Management System" (1-3 words). Product is "Payroll Management System" by Campcodes. But to be precise: "Campcodes Payroll Management System" is 4 words. Could be "Payroll Management System"? Usually referred as "Campcodes Payroll Management System" but we can use just "Payroll Management System" with vendor in context. But requirement: "3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the vendor alone, NOT a description. If multiple products, pick the primary one." So "Campcodes Payroll Management System" is 3 words: Campcodes, Payroll, Management, System = 4 words. "Payroll Management System" is 3 words. It's acceptable, but it might be too generic. Maybe "Campcodes Payroll System"? That's 3. However, the CPE is "campcodes:payroll_management_system". I'll output "Campcodes Payroll Management System" as 4 words? No, I'll try "Payroll Management System" – but there's a risk it's not specific. But the guideline says "product or service name", and examples like "WordPress" not "WordPres