Which versions of PHP are affected by CVE-2025-7467?

A publicly disclosed SQL injection vulnerability in Modern Bag 1.0 allows remote attackers to potentially access, modify, or exfiltrate sensitive database information without authentication.

Is there a public PoC exploit available for CVE-2025-7467?

Yes, a public proof-of-concept exploit is available for CVE-2025-7467. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-7467?

Within 24 hours: Identify all systems running Modern Bag 1.0 and isolate them from production networks if possible; enable enhanced logging on affected systems. Within 7 days: Deploy WAF rules to block malicious SQL injection patterns targeting /product-detail.php ID parameter; implement input validation and output encoding at the application layer. Within 30 days: Evaluate alternative solutions or upgrade to a patched version when available; conduct forensic review of database access logs for evidence of exploitation.

PHP CVE-2025-7467

Q: What is the CVSS score of CVE-2025-7467?

CVE-2025-7467 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-21214 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-12 cna@vuldb.com

PHP SQLi Modern Bag Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 08:56 euvd

EUVD-2025-21214

Analysis Generated

Mar 16, 2026 - 08:56 vuln.today

PoC Detected

Jul 15, 2025 - 15:44 vuln.today

Public exploit code

CVE Published

Jul 12, 2025 - 09:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability, which was classified as critical, was found in code-projects Modern Bag 1.0. This affects an unknown part of the file /product-detail.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7467 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0 affecting the /product-detail.php file's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially exfiltrate, modify, or delete database contents. The vulnerability has been publicly disclosed with exploit code available, and the CVSS 7.3 score reflects moderate-to-high real-world impact with low attack complexity and no authentication requirements.

Technical ContextAI

This vulnerability exploits improper input validation in PHP-based e-commerce software (code-projects Modern Bag 1.0), classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component—'Injection'). The root cause is insufficient parameterization or sanitization of the ID query parameter in /product-detail.php before it is incorporated into SQL queries, allowing attackers to inject malicious SQL syntax. The affected software is an e-commerce shopping bag/cart management system written in PHP, typically deployed on LAMP stacks (Linux, Apache, MySQL, PHP). The vulnerability is a classic second-order or first-order SQL injection flaw where user-controlled input directly influences SQL construction without prepared statements or proper escaping.

RemediationAI

Immediate actions: (1) Apply the latest security patch from code-projects if available—check vendor website or security advisory page for Modern Bag > 1.0 release notes. (2) If no patch is available, implement input validation and parameterized queries: Replace all direct SQL concatenation in /product-detail.php with prepared statements (using mysqli prepared statements or PDO with bound parameters) for the ID parameter. (3) Short-term workaround: Implement a Web Application Firewall (WAF) rule to block SQL injection patterns in the ID parameter (e.g., detect quotes, UNION, OR 1=1, etc.). (4) Restrict database user privileges to read-only where possible. (5) Enable SQL query logging and monitor for suspicious patterns. (6) Consider disabling the /product-detail.php endpoint until patched if it is not business-critical. Upgrade to a patched version as soon as released by code-projects.