Which versions of PHP are affected by CVE-2025-7410?

A critical SQL injection vulnerability in LifeStyle Store 1.0 allows unauthenticated remote attackers to compromise database integrity and potentially access sensitive customer data.

Is there a public PoC exploit available for CVE-2025-7410?

Yes, a public proof-of-concept exploit is available for CVE-2025-7410. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-7410?

Within 24 hours: Isolate affected LifeStyle Store 1.0 instances from production or implement emergency WAF rules to block /cart_remove.php requests with suspicious ID parameters; notify stakeholders and customers of potential exposure. Within 7 days: Deploy network segmentation to restrict database access, enable SQL query logging and monitoring, and conduct database audit for unauthorized access. Within 30 days: Upgrade to a patched version when available, or decommission the application if no vendor patch is released; perform forensic analysis to determine if systems were exploited.

PHP CVE-2025-7410

Q: What is the CVSS score of CVE-2025-7410?

CVE-2025-7410 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-21014 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-10 cna@vuldb.com

PHP SQLi Lifestyle Store Anisha

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 06:52 euvd

EUVD-2025-21014

Analysis Generated

Mar 16, 2026 - 06:52 vuln.today

PoC Detected

Jul 16, 2025 - 15:02 vuln.today

Public exploit code

CVE Published

Jul 10, 2025 - 17:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects LifeStyle Store 1.0. It has been classified as critical. Affected is an unknown function of the file /cart_remove.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7410 is a critical SQL injection vulnerability in code-projects LifeStyle Store version 1.0, affecting the /cart_remove.php file's ID parameter. An unauthenticated remote attacker can exploit this vulnerability over the network to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.

Technical ContextAI

This vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which describes the failure to sanitize user input before SQL operations. The /cart_remove.php file accepts an ID parameter that is directly concatenated or used in SQL queries without proper parameterized query use or input validation. The LifeStyle Store application (code-projects version 1.0) is a PHP-based e-commerce platform where the cart removal functionality should validate and escape all user-supplied ID values before database operations. The lack of prepared statements or parameterized queries allows attackers to inject malicious SQL syntax through the ID parameter, bypassing intended application logic.

RemediationAI

Immediate actions: (1) Apply input validation to the ID parameter in /cart_remove.php—whitelist numeric-only values if ID is intended to be numeric, or use strict type checking. (2) Implement parameterized prepared statements (mysqli prepared statements or PDO prepared statements in PHP) for all database queries instead of string concatenation. (3) Use an ORM framework (e.g., Doctrine, Eloquent) that automatically handles query parameterization. (4) Implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in the ID parameter. (5) Contact code-projects for an official patch or security update; if unavailable, consider forking or replacing the application with maintained alternatives. (6) Temporarily, restrict access to /cart_remove.php via IP allowlisting or authentication enforcement until patched. Long-term: migrate to a maintained e-commerce platform with active security updates.