EUVD-2025-21218Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was found in code-projects Modern Bag 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/login-back.php. The manipulation of the argument user-name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
CVE-2025-7471 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0 affecting the /admin/login-back.php endpoint. An unauthenticated remote attacker can inject malicious SQL code via the 'user-name' parameter to compromise confidentiality, integrity, and availability of the application and underlying database. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing real-world exploitation risk.
Technical ContextAI
This vulnerability stems from improper input validation and parameterization in the login authentication mechanism. The root cause is classified under CWE-74 (Improper Neutralization of Special Elements in Output), though the actual exploitation vector appears to be CWE-89 (SQL Injection). The vulnerable code path processes user-supplied input from the 'user-name' parameter directly into SQL queries without proper prepared statements or parameterized query execution. Modern Bag 1.0 is a PHP-based application (inferred from .php extension), and the vulnerability likely exists in the authentication handler before privilege checks occur. The attack surface is the publicly accessible admin login interface, which makes the unauthenticated attack vector feasible.
RemediationAI
Immediate Mitigation: Restrict network access to /admin/login-back.php via firewall rules or WAF; limit admin interface exposure to known IP ranges only Application-Level Workaround: Implement input validation regex: reject user-name parameters containing SQL metacharacters (single quotes, double quotes, semicolons, dashes, asterisks). Deploy a WAF rule to block SQL keywords (SELECT, UNION, DROP, etc.) in the user-name field Code-Level Patch: Replace all SQL query concatenation in login-back.php with parameterized prepared statements using bound variables (mysqli prepared statements or PDO parameterized queries). Example: use prepared statement with ? placeholders instead of string interpolation Version Update: Check code-projects official repository/advisories for Modern Bag version >1.0 patch release. If unavailable, consider alternative admin authentication libraries Detection & Monitoring: Enable SQL error logging; monitor for unusual query patterns in database logs; set IDS/IPS signatures to detect SQL injection payloads (UNION, OR 1=1, stacked queries) in admin login POST requests
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today