Which versions of PHP are affected by CVE-2025-7409?

A critical SQL injection vulnerability in Mobile Shop 1.0 allows unauthenticated remote attackers to compromise the application through the admin login function.

Is there a public PoC exploit available for CVE-2025-7409?

Yes, a public proof-of-concept exploit is available for CVE-2025-7409. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-7409?

Within 24 hours: Isolate affected Mobile Shop 1.0 instances from production networks or disable the /LoginAsAdmin.php endpoint immediately. Within 7 days: Conduct forensic audit of admin login logs and database access for signs of exploitation; prepare migration plan to alternate solutions. Within 30 days: Complete migration to patched version or alternative application; if continued use is mandatory, implement comprehensive WAF rules blocking SQL injection patterns on the affected endpoint.

PHP CVE-2025-7409

Q: What is the CVSS score of CVE-2025-7409?

CVE-2025-7409 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-21023 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-10 cna@vuldb.com

PHP SQLi Mobile Shop Anisha

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 06:52 euvd

EUVD-2025-21023

Analysis Generated

Mar 16, 2026 - 06:52 vuln.today

PoC Detected

Jul 16, 2025 - 15:03 vuln.today

Public exploit code

CVE Published

Jul 10, 2025 - 17:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Mobile Shop 1.0 and classified as critical. This issue affects some unknown processing of the file /LoginAsAdmin.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7409 is a critical SQL injection vulnerability in code-projects Mobile Shop 1.0 affecting the /LoginAsAdmin.php endpoint, where the 'email' parameter is improperly sanitized, allowing unauthenticated remote attackers to inject arbitrary SQL commands. The vulnerability has been publicly disclosed with exploits available, making it actively exploitable in the wild. With a CVSS score of 7.3 and network-accessible attack vector, this poses significant risk to confidentiality, integrity, and availability of affected systems.

Technical ContextAI

The vulnerability exists in the /LoginAsAdmin.php file of code-projects Mobile Shop 1.0, a PHP-based e-commerce application. The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which manifests as SQL injection through inadequate input validation/parameterization on the 'email' parameter in admin login processing. The application fails to use prepared statements or proper escaping mechanisms when constructing SQL queries, allowing attackers to inject malicious SQL syntax directly into database queries. This is a classic authentication bypass and data exfiltration vector in PHP applications lacking parameterized queries (mysqli prepared statements, PDO prepared statements, or ORM frameworks).

RemediationAI

Immediate actions: (1) Upgrade to patched version if available from code-projects (vendor advisory/patch status unknown from provided data—contact vendor directly); (2) If no patch exists, implement Web Application Firewall (WAF) rules to block SQL injection payloads in email parameter (detect patterns: UNION, OR 1=1, --, ;, xp_, etc.); (3) Disable or restrict access to /LoginAsAdmin.php via IP whitelisting or authentication gateway; (4) Implement input validation: whitelist email format validation (RFC 5322 compliant regex), reject non-alphanumeric/special-char patterns before query; (5) Code-level fix (if patching source): convert all SQL queries to parameterized statements using prepared statements (mysqli_prepare + mysqli_bind_param or PDO prepared statements); (6) Enable SQL error suppression to prevent information disclosure; (7) Conduct security audit of other endpoints for similar SQL injection vectors; (8) Monitor database logs for suspicious query patterns. Long-term: Consider sunsetting Mobile Shop 1.0 in favor of actively maintained e-commerce platforms.