What is the CVSS score of CVE-2025-7411?

CVE-2025-7411 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2025-7411?

Yes, a public proof-of-concept exploit is available for CVE-2025-7411. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-7411?

Within 24 hours: Isolate affected LifeStyle Store 1.0 instances from production traffic or take the application offline; notify security team and relevant stakeholders. Within 7 days: Implement Web Application Firewall (WAF) rules blocking malicious ID parameter payloads to /success.php; conduct database audit for unauthorized access; review access logs for exploitation attempts. Within 30 days: Either upgrade to a patched version when available or decommission the application; perform comprehensive security assessment and penetration testing; restore any compromised data from clean backups.

Lifestyle Store CVE-2025-7411

EUVD-2025-21046 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-10 cna@vuldb.com

PHP SQLi Lifestyle Store Anisha

5.5

CVSS 4.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-74 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Input neutralization, injection prevention
Impact	While CVSS 7.3 suggests moderate severity, the real-world risk profile is elevated by multiple aggravating factors: (1) CVSS vector AV:N/AC:L/PR:N/UI:N indicates trivial attack execution requiring no authentication or user interaction from a network-accessible endpoint, (2) Public proof-of-concept code availability dramatically increases exploitation likelihood and EPSS score, (3) SQL injection enables complete database compromise including credential theft, customer PII exfiltration, and transaction tampering, (4) CWE-74 is consistently in OWASP Top 10 and is actively weaponized. The moderate CVSS score undersells impact—C/I/A ratings of 'Low' reflect the CVSS model's bias toward direct system availability, not data breach severity. This should be treated as critical for any production deployment.
Exploit ScenarioDerived	An attacker discovers LifeStyle Store 1.0 deployment via web enumeration. They craft a malicious URL such as `http://target.com/success.php?ID=1' UNION SELECT user(),version(),database()--` or `ID=1; DROP TABLE customers;--` and send it without authentication or user interaction required. The unvalidated parameter is directly concatenated into a SQL query, executing attacker-controlled SQL. Attack outcomes: (1) Data exfiltration—dumping customer records, emails, passwords, payment info via UNION-based injection, (2) Authentication bypass—modifying order status or user privileges, (3) Destructive attacks—truncating tables or dropping the database. Given public POC availability, automated scanning tools will rapidly identify and exploit all unpatched instances. Attack complexity is negligible—no exploitation skill barrier exists.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 16, 2026

CVE-2025-7411 is a critical SQL injection vulnerability in code-projects LifeStyle Store 1.0 affecting the /success.php endpoint's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially read/modify sensitive data. Public exploit code is available and the vulnerability is likely actively exploited in the wild, making this a high-priority remediation target despite the moderate CVSS 7.3 score which reflects limited immediate system impact rather than true severity.

RemediationAI

Immediate actions: (1) Apply input validation: implement parameterized prepared statements using mysqli_prepare() or PDO prepared statements to eliminate SQL injection, (2) Code fix example—replace direct concatenation in /success.php with prepared statements: $stmt = $conn->prepare('SELECT * FROM orders WHERE id = ?'); $stmt->bind_param('i', $_GET['ID']); $stmt->execute();, (3) Input sanitization: whitelist/validate ID parameter as integer-only using intval() or type casting, (4) Web Application Firewall (WAF) rule: deploy ModSecurity or similar to block SQL metacharacters in GET parameters, (5) No official patch identified—contact code-projects maintainers immediately or migrate to maintained fork if available. Workaround: Restrict /success.php access via authentication token validation until patched.

Affected VersionsENISA

LifeStyle Store 1.0

Affected Packages

euvd lifestyle_store no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability represents a classic CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection') SQL injection flaw in PHP-based e-commerce software. The /success.php file fails to properly sanitize or parameterize the 'ID' parameter before incorporation into SQL queries, likely during order confirmation or transaction processing workflows. The affected product LifeStyle Store 1.0 is a PHP/MySQL-based e-commerce application from code-projects. The vulnerability exploits insufficient input validation in server-side request handling, bypassing database query protection mechanisms.

Know when Lifestyle Store gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

PoC Detected

Jul 16, 2025 - 15:02 vuln.today

Public exploit code

CVE Published

Jul 10, 2025 - 19:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects LifeStyle Store 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /success.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Executive ViewAI

Why It Matters

A publicly disclosed SQL injection vulnerability exists in LifeStyle Store 1.0 that allows remote attackers to compromise database integrity and access sensitive data through the /success.php endpoint. With no patch currently available and active public exploits circulating, immediate mitigation is critical to prevent unauthorized data extraction or manipulation affecting customer information.

Business Impact: High

Compensating Controls

Implement WAF rules to filter SQL injection patterns in the ID parameter; restrict network access to /success.php to authorized users only; disable the affected functionality until patch availability; apply input validation and parameterized queries via code review; enable database activity monitoring and alerting; implement request logging for forensic analysis; consider deploying API gateway to sanitize input parameters.

Threat Intelligence Overview

EPSS Score

0.0%

Top 86% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.