Is there a public PoC exploit available for CVE-2025-7477?

Yes, a public proof-of-concept exploit is available for CVE-2025-7477. Prioritise patching immediately. EPSS: 0.1%.

Simple Car Rental System CVE-2025-7477

Q: What is the CVSS score of CVE-2025-7477?

CVE-2025-7477 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-21223 LOW

Improper Access Control (CWE-284)

2025-07-12 cna@vuldb.com

PHP Authentication Bypass File Upload Simple Car Rental System Fabian

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Admin upload can lead to arbitrary code execution; high impact justified despite high privileges

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.7 (MEDIUM) 2.0 (LOW)

EUVD ID Assigned

Mar 16, 2026 - 08:56 euvd

EUVD-2025-21223

Analysis Generated

Mar 16, 2026 - 08:56 vuln.today

PoC Detected

Oct 23, 2025 - 20:06 vuln.today

Public exploit code

CVE Published

Jul 12, 2025 - 15:15 cve.org

LOW 2.0

CVE Published

Jul 12, 2025 - 15:15 nvd

MEDIUM 4.7

DescriptionCVE.org

A vulnerability, which was classified as critical, has been found in code-projects Simple Car Rental System 1.0. This issue affects some unknown processing of the file /admin/add_cars.php. The manipulation of the argument image leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Unrestricted file upload in Code-projects Simple Car Rental System 1.0 allows authenticated administrators to upload malicious files via /admin/add_cars.php, potentially leading to remote code execution. A public proof-of-concept exploit exists, but no active exploitation has been reported. EPSS score of 0.07% indicates low probability of widespread attacks.

Technical ContextAI

The vulnerability resides in the PHP-based Simple Car Rental System, specifically in the image upload functionality of /admin/add_cars.php. It stems from insufficient validation of uploaded files, classified under CWE-284 (Improper Access Control) regarding upload restrictions. The affected product is identified by CPE cpe:2.3:a:fabian:simple_car_rental_system:1.0, indicating a single affected version from the Fabian project.

RemediationAI

No official patch is available. Immediately restrict access to the admin panel (e.g., via IP allowlisting or .htaccess) and ensure strong admin credentials. Disable the file upload feature if not essential, or implement server-side validation of uploaded file types, content inspection, and store uploads outside the web root to prevent script execution. Consider deploying a web application firewall to block malicious file uploads. The exploit reference at https://github.com/y2xsec324/cve/issues/14 can be used to test the vulnerability but does not provide a fix.