Which versions of PHP are affected by CVE-2025-7461?

A remote SQL injection vulnerability in Modern Bag 1.0 allows unauthenticated attackers to compromise database integrity and extract sensitive data.

Is there a public PoC exploit available for CVE-2025-7461?

Yes, a public proof-of-concept exploit is available for CVE-2025-7461. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-7461?

Within 24 hours: Inventory all systems running Modern Bag 1.0 and assess internet exposure. Implement WAF rules blocking SQL injection patterns in the proId parameter. Within 7 days: Isolate affected systems to restricted network segments, disable /action.php if operationally feasible, and establish enhanced logging/monitoring. Within 30 days: Evaluate replacement solutions or request emergency patch from vendor; if unavailable, plan application decommissioning or air-gap deployment.

PHP CVE-2025-7461

Q: What is the CVSS score of CVE-2025-7461?

CVE-2025-7461 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-21203 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-12 cna@vuldb.com

PHP SQLi Modern Bag Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 08:56 euvd

EUVD-2025-21203

Analysis Generated

Mar 16, 2026 - 08:56 vuln.today

PoC Detected

Jul 15, 2025 - 18:34 vuln.today

Public exploit code

CVE Published

Jul 12, 2025 - 05:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Modern Bag 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /action.php. The manipulation of the argument proId leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7461 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0, located in the /action.php file's proId parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially access, modify, or delete database contents. The vulnerability has been publicly disclosed with exploit code available, and the CVSS 7.3 score reflects moderate confidentiality, integrity, and availability impact; however, the attack requires no authentication or user interaction, making it immediately exploitable in network-accessible deployments.

Technical ContextAI

Modern Bag 1.0 is a PHP-based application that fails to properly sanitize user input in the proId parameter passed to /action.php, allowing SQL injection via CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The vulnerable code path likely constructs SQL queries through direct string concatenation of the proId parameter without using prepared statements or parameterized queries. This is a classic web application vulnerability where user-controlled input is treated as executable SQL code rather than data, enabling attackers to alter query logic, extract sensitive data, or modify database records.

RemediationAI

IMMEDIATE: If running Modern Bag 1.0 in production, isolate or take offline pending patched version availability. 2) Contact code-projects vendor directly for patch status and expected release timeline. 3) Implement Web Application Firewall (WAF) rules to block SQL injection patterns in proId parameter (e.g., blocking SQL keywords like UNION, SELECT, DROP in this parameter). 4) Apply strict input validation: whitelist acceptable proId values (e.g., numeric-only if product IDs are numeric). 5) Upgrade to patched Modern Bag version once available from vendor. 6) If no patch is forthcoming, consider replacing Modern Bag with a maintained alternative that implements secure coding practices (parameterized queries, input validation, principle of least privilege for database accounts). 7) Review database access logs for signs of exploitation.