PHP CVE-2025-7466

While assigned CVSS 3.1 score of 7.3 (High), the real-world risk is CRITICAL based on multiple aggravating factors: (1) Attack Vector is Network with zero authentication required (PR:N), (2) Attack Complexity is Low, indicating trivial exploitation, (3) Exploit code is publicly disclosed and accessible, (4) SQL injection impacts confidentiality, integrity, and availability equally (C:L/I:L/A:L, all three security properties compromised), (5) The application appears to be a business-critical courier management system likely handling sensitive operational and financial data. The CVSS vector demonstrates a textbook remote code execution path. The combination of public POC availability, unauthenticated remote access, and simple exploitation mechanism elevates this beyond the numerical score—this should be treated as an emergency priority for any organization running this software. The 'critical' classification in the CVE description appears understated given the CVSS metrics.

An attacker discovers the publicly available exploit for CVE-2025-7466 and crafts a malicious HTTP request to the vulnerable /add_dealerrequest.php endpoint with a SQL injection payload in the 'Name' parameter such as: 'Name=test' OR '1'='1' UNION SELECT username, password FROM users--'. Since PR:N and AC:L, no authentication or complex conditions are required. The application constructs and executes the malicious SQL query directly against the backend database. The attacker successfully extracts sensitive data (courier information, financial records, customer details), modifies database records, or deletes critical data. In a worst-case scenario, if database user privileges are misconfigured, the attacker may execute operating system commands via database functions, achieving complete system compromise. The attack takes minutes to execute and requires only basic SQL knowledge and a web browser or curl command.