Which versions of PHP are affected by CVE-2025-7459?

A publicly disclosed SQL injection vulnerability in Mobile Shop 1.0 allows remote attackers to manipulate the /EditMobile.php file, potentially exposing sensitive customer and business data.

Is there a public PoC exploit available for CVE-2025-7459?

Yes, a public proof-of-concept exploit is available for CVE-2025-7459. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-7459?

Within 24 hours: Identify all systems running Mobile Shop 1.0 and isolate them from production networks if possible; enable enhanced logging and monitoring on affected applications. Within 7 days: Deploy WAF rules to block malicious SQL injection patterns targeting /EditMobile.php; implement input validation and parameterized query fixes if code access exists. Within 30 days: Evaluate replacement or upgrade options for Mobile Shop 1.0; contact vendor for patch status and ETA; conduct forensic audit for evidence of exploitation.

PHP CVE-2025-7459

Q: What is the CVSS score of CVE-2025-7459?

CVE-2025-7459 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-21187 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-11 cna@vuldb.com

PHP SQLi Mobile Shop Anisha

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 08:18 euvd

EUVD-2025-21187

Analysis Generated

Mar 16, 2026 - 08:18 vuln.today

PoC Detected

Jul 16, 2025 - 14:58 vuln.today

Public exploit code

CVE Published

Jul 11, 2025 - 21:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability classified as critical was found in code-projects Mobile Shop 1.0. This vulnerability affects unknown code of the file /EditMobile.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7459 is a SQL injection vulnerability in code-projects Mobile Shop version 1.0, specifically in the /EditMobile.php file's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with proof-of-concept code available, creating immediate risk for deployed instances. With a CVSS score of 7.3 and network-accessible attack vector, this poses significant risk to confidentiality, integrity, and availability of affected databases.

Technical ContextAI

The vulnerability exists in the /EditMobile.php file of Mobile Shop 1.0, where user-supplied input via the ID parameter is improperly sanitized before being incorporated into SQL queries. This represents a classic CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection') vulnerability. The root cause is likely insufficient input validation/parameterization of the ID parameter, allowing attackers to inject malicious SQL syntax. The affected component is a PHP-based mobile shopping application with direct database interaction in the edit functionality, suggesting inadequate use of prepared statements or parameterized queries.

RemediationAI

Immediate actions: (1) Apply a security patch from code-projects if available - verify the vendor's official advisory/patch repository for Mobile Shop 1.0.x hotfixes; (2) If no patch exists, implement input validation by enforcing strict parameterized/prepared SQL queries for all ID parameter handling in /EditMobile.php, ensuring the ID is cast to an integer type before SQL execution; (3) Temporary mitigation: restrict access to /EditMobile.php via WAF rules or network segmentation until patches are applied; (4) Implement database-level least-privilege principles to limit SQL injection damage scope. Long-term: upgrade to a newer version of Mobile Shop if available, or migrate to actively maintained alternatives. Conduct code review of all PHP files handling user input to identify similar injection vulnerabilities.