Which versions of PHP are affected by CVE-2025-7476?

A publicly disclosed SQL injection vulnerability in the Simple Car Rental System admin approval module allows remote attackers to compromise database integrity and potentially access sensitive…

Is there a public PoC exploit available for CVE-2025-7476?

Yes, a public proof-of-concept exploit is available for CVE-2025-7476. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-7476?

Within 24 hours: Assess deployment scope and isolate affected systems from production networks if possible; implement WAF rules to block malicious SQL patterns in the ID parameter; disable the /admin/approve.php functionality if operationally feasible. Within 7 days: Conduct forensic analysis of logs to detect exploitation attempts; implement network segmentation restricting admin access to specific IP ranges; enforce principle of least privilege on database accounts. Within 30 days: Monitor vendor for patch availability and deploy immediately upon release; evaluate alternative car rental management systems if vendor abandons support; implement database activity monitoring and enhanced input validation.

PHP CVE-2025-7476

Q: What is the CVSS score of CVE-2025-7476?

CVE-2025-7476 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-21221 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-12 cna@vuldb.com

PHP SQLi Simple Car Rental System Fabian

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 08:56 euvd

EUVD-2025-21221

Analysis Generated

Mar 16, 2026 - 08:56 vuln.today

PoC Detected

Oct 23, 2025 - 20:06 vuln.today

Public exploit code

CVE Published

Jul 12, 2025 - 14:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability classified as critical was found in code-projects Simple Car Rental System 1.0. This vulnerability affects unknown code of the file /admin/approve.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7476 is a critical SQL injection vulnerability in code-projects Simple Car Rental System 1.0 affecting the /admin/approve.php endpoint's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, elevating real-world risk despite the CVSS 7.3 score suggesting moderate impact.

Technical ContextAI

The vulnerability exists in the Simple Car Rental System 1.0, a web-based vehicle rental management application. The root cause is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which encompasses SQL injection flaws. Specifically, the /admin/approve.php file fails to properly sanitize or parameterize the 'ID' parameter before incorporating it into SQL queries. This is a classic first-order SQL injection vulnerability where user-supplied input is directly concatenated into SQL statements without escape sequences or prepared statement usage. The affected technology stack likely includes PHP as the backend language (evident from .php file extension) and a relational database (MySQL, PostgreSQL, or similar) commonly used in rental management systems.

RemediationAI

Immediate remediation steps: (1) Apply any available security patches from code-projects (check GitHub repository for version 1.1 or later with SQL injection fixes); (2) If no patch is available, implement input validation by: parameterizing all SQL queries using prepared statements with bound parameters (mysqli_prepare or PDO prepared statements in PHP), implementing whitelist validation on the 'ID' parameter (numeric range check if it should be numeric), and applying strict type-casting (cast $ID to integer if appropriate); (3) Implement Web Application Firewall (WAF) rules to detect/block SQL injection payloads (e.g., common patterns: 'OR 1=1', UNION SELECT, stacked queries); (4) Restrict /admin/approve.php access via network segmentation or IP allowlisting to trusted admin networks; (5) Enable SQL error suppression in production to prevent information leakage, and log all database query errors for monitoring.