Job Diary CVE-2025-7474

This vulnerability presents substantial real-world risk despite a moderate CVSS 3.1 score of 7.3. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates network-accessible, low-complexity exploitation requiring no authentication or user interaction—factors that maximize real-world threat potential. The public disclosure of working exploits, confirmed KEV status, and evidence of active exploitation significantly elevate risk beyond the base CVSS score. Using SSVC framework: exploitation status is confirmed/active (POC public), the attack is likely automatable via SQLi tools, and technical impact includes confidentiality, integrity, and availability breaches. EPSS scoring would likely exceed 90% given public POC and active exploitation signals. This is a legitimate high-priority vulnerability requiring immediate action, not a false-positive high-CVSS case.

An attacker identifies a Job Diary 1.0 installation via reconnaissance and crafts a malicious URL: http://target.com/search.php?Search=test' OR '1'='1. The unsanitized Search parameter is concatenated directly into an SQL query (e.g., SELECT * FROM jobs WHERE title LIKE '%{Search}%'), resulting in SELECT * FROM jobs WHERE title LIKE '%test' OR '1'='1%'. The database executes this modified query, bypassing intended filtering logic and returning all records. An attacker escalates this to UNION-based injection (test' UNION SELECT user(), database(), version()--) to extract database credentials, version info, and sensitive data. Given AV:N and AC:L, the attacker can automate this attack using SQLmap or custom scripts without authentication, potentially exfiltrating entire user databases, modifying job listings, or deleting records. Public POC availability means low-skill attackers can execute this attack within minutes.