Which versions of PHP are affected by CVE-2025-7457?

A critical SQL injection vulnerability in the Campcodes Online Movie Theater Seat Reservation System allows attackers to remotely compromise the administrative interface and access sensitive database…

Is there a public PoC exploit available for CVE-2025-7457?

Yes, a public proof-of-concept exploit is available for CVE-2025-7457. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-7457?

Within 24 hours: Identify all systems running Campcodes version 1.0 and restrict network access to /admin/manage_movie.php to authorized personnel only. Within 7 days: Deploy WAF rules to block SQL injection patterns in the ID parameter and implement input validation filtering. Within 30 days: Upgrade to a patched version when available, or evaluate alternative solutions if the vendor cannot provide timely remediation.

PHP CVE-2025-7457

Q: What is the CVSS score of CVE-2025-7457?

CVE-2025-7457 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-21188 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-11 cna@vuldb.com

PHP SQLi Online Movie Theater Seat Reservation System Campcodes

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 08:18 euvd

EUVD-2025-21188

Analysis Generated

Mar 16, 2026 - 08:18 vuln.today

PoC Detected

Jul 16, 2025 - 14:58 vuln.today

Public exploit code

CVE Published

Jul 11, 2025 - 21:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability, which was classified as critical, was found in Campcodes Online Movie Theater Seat Reservation System 1.0. This affects an unknown part of the file /admin/manage_movie.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7457 is a critical SQL injection vulnerability in Campcodes Online Movie Theater Seat Reservation System version 1.0, affecting the /admin/manage_movie.php file's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising database confidentiality, integrity, and availability. Public disclosure and exploit availability elevate the risk profile significantly.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements used in an SQL Command) in a PHP-based web application. The /admin/manage_movie.php endpoint fails to properly sanitize or parameterize the ID parameter before incorporating it into SQL queries. This allows attackers to inject malicious SQL syntax directly into the query logic. The affected product is a theater seat reservation system, typically handling sensitive reservation data, user credentials, and payment information. Without input validation or prepared statements, the application is vulnerable to UNION-based, Boolean-based, time-based, or error-based SQL injection attacks. The lack of authentication requirements on this admin function compounds the severity.

RemediationAI

Immediate actions: (1) If running Campcodes 1.0, apply an emergency patch or upgrade to a patched version (check vendor website or contact vendor support for patch availability; if none exists, consider alternative products); (2) Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the ID parameter (e.g., block single quotes, SQL keywords like UNION, SELECT in parameter values); (3) Restrict network access to /admin/manage_movie.php via IP whitelisting or require VPN access; (4) Implement mandatory authentication/authorization checks on all admin functions. Long-term remediation: (1) Require use of parameterized queries (prepared statements) for all database interactions; (2) Conduct a full code review of the application for similar SQL injection vulnerabilities in other admin endpoints; (3) Implement input validation and output encoding best practices per OWASP guidelines; (4) Consider migrating to a modern, actively-maintained reservation system with security-first architecture.