PHP CVE-2025-7489

We need to generate a JSON object with multiple fields, each a plain text string. The CVE is CVE-2025-7489, a SQL injection in PHPGurukul Vehicle Parking Management System 1.13. The description says: "A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13 and classified as critical. This issue affects some unknown processing of the file /admin/search-vehicle.php. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used."

Data provided: CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... (likely the base vector without temporal, but it's included in the CVSS field). EPSS: 0.06% (low). No KEV status, so not actively exploited. POC publicly available. CWE-74 (improper neutralization of special elements in output used by a downstream component ('Injection')), but specific to SQL injection? The CWE-74 is a broad parent. Possibly the description says SQL injection. Tags: PHP, SQLi. So it's a classic SQLi.

Product: PHPGurukul Vehicle Parking Management System 1.13. That's a PHP application for vehicle parking management. The vulnerability is in the admin section: /admin/search-vehicle.php with searchdata parameter. So authenticated? The CVSS 4.0 vector includes PR:L (privileges required low). So it requires some low privilege, likely admin login. So it's authenticated SQL injection. The exploit is disclosed. EPSS 0.06% very low.

We need to fill fields:

• product_name: "Vehicle Parking Management System" (3 words). "PHPGurukul Vehicle Parking Management System" is longer, but I'll pick the product name: "Vehicle Parking Management System". Or better "PHPGurukul Vehicle Parking Management System"? Only 3 words. Maybe "Vehicle Parking Management" (3 words) but that's too generic. The CPE product is php_file_manager? Actually CPE: cpe:2.3:a:phpgurukul:vehicle_parking_management_system:1.13. So product name is "Vehicle Parking Management System". That's 4 words: Vehicle, Parking, Management, System. I can use "Vehicle Parking Management System" (4 words). The instruction says "1-3 words ONLY." So I must condense. Options: "Vehicle Parking Management" (3 words) but that might miss "System". Could be "PHPGurukul Parking Management" but that's 3 words. The vendor is PHPGurukul. I'll use "Parking Management System" (3 words) but that might be ambiguous. Better: "Vehicle Parking System" (3 words). That's short, but the official name is "Vehicle Parking Management System". I'll use "Vehicle Parking Management System" as 4 words? The instruction is strict: "1-3 words ONLY." So maybe "PHPGurukul Parking System"? Not exactly. The important thing is to uniquely identify. I'll use "Vehicle Parking Management" (3 words: Vehicle, Parking, Management). That's acceptable. I'll go with "Vehicle Parking Management System" actually violates the word count. Let's count: "Vehicle" (1), "Parking" (2), "Management" (3), "System" (4). So 4 words. So I'll use "PHPGurukul Parking Mgmt" not consistent. I'll follow the instruction strictly: 1-3 words only. I'll pick "PHPGurukul Vehicle Parking" (3 words) but that's not the product name. The product name is "Vehicle Parking Management System". I'll try "PHPGurukul Parking System" (3 words). Might work. However, the CPE says "vehicle_parking_management_system". The product name is "Vehicle Parking Management System". I'll output "Vehicle Parking Management" (3 words). That accurately denotes the software. I'll use "Vehicle Parking Management". That's fine.
• summary: Start with specific impact verb and product. It's SQL injection, remote, authenticated low-privilege user can perform SQL injection on search parameter. POC publicly available. EPSS very low. So summary: "Authenticated SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows low-privileged remote attackers to execute arbitrary SQL commands via the searchdata parameter in /admin/search-vehicle.php, potentially leading to data exfiltration or manipulation." And mention exploit public, low EPSS risk. Not actively exploited. Use original synthesis: "Authenticated SQL injection in PHPGurukul Vehicle Parking Management System 1.13 enables remote low-privileged attackers to inject SQL via the searchdata parameter of the admin search-vehicle endpoint, potentially leading to data theft or tampering. Public exploit code is available, but EPSS indicates a low exploitation probability (0.06%) and no active exploitation has been reported."
• technical_context: "The vulnerability resides in a PHP-based web application using the MySQL database. The /admin/search-vehicle.php endpoint likely constructs SQL queries by concatenating unsanitized user input from the 'searchdata' parameter, corresponding to CWE-89 (SQL Injection). The affected product, per CPE cpe:2.3:a:phpgurukul:vehicle_parking_management_system:1.13, is a vehicle parking management system by PHPGurukul. The root cause is improper neutralization of special elements in SQL queries, allowing attackers to modify query logic." I'll mention CWE-74 but map to SQL injection.
• risk_assessment: Using CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So network exploitable, low user interaction, low privileges required, impacts low confidentiality, integrity, availability (all low) on the vulnerable system only. CVSS score 2.1? Wait, NVD gave CVSS score 2.1, but with vector that rates low impact? Score is 2.1 (Low). EPSS 0.06% very low. KEV not listed, so not actively exploited. Public exploit available but that hasn't translated into high exploitation. So risk is low despite being "critical" classification in description (vuldb may have classified critical). Real risk seems low because it requires authentication and low impact, but SQL injection could lead to data compromise. I need to assess using SSVC: exploitation status: no active exploitation; automatable: likely automatable (simple request); technical impact: partial (low impacts per CVSS). So a low priority. I'll state: "While the vulnerability is critical per the vendor, CVSS 4.0 scores it at 2.1 (Low) due to low impacts and required low privileges. EPSS confirms low exploitation probability. No KEV listing. The attack requires authentication, limiting exposure to users with valid credentials. Overall real-world risk is low, but organizations using this system should still patch given public exploit availability." I'll compare signals.
• affected_products: "PHPGurukul Vehicle Parking Management System version 1.13 is confirmed affected. No other versions are listed. Vendor advisory not available. References include the NVD entry and a GitHub exploit report." I'll list the version.
• remediation: "Upgrade to a patched version if available; as of now, no official fix has been released. As a workaround, implement input validation (prepared statements) on the searchdata parameter in /admin/search-vehicle.php, or apply a web application firewall rule to block SQL injection patterns. Disabling the vulnerable search feature may be a temporary measure. Monitor vendor site (https://phpgurukul.com/) for patches." I need to be specific: exact version not given, so "no vendor-released patch identified". The references are exploit and vuldb pages, no patch. So remediation: "No vendor-released patch identified. As an immediate mitigation, modify the application code to use parameterized queries, or restrict access to the admin panel to trusted IP addresses. Alternatively, disable the search-vehicle.php endpoint until a fix is available. Follow vendor updates at https://phpgurukul.com/."
• exploit_scenario: "A low-privileged attacker with access to the admin dashboard submits a malicious SQL payload via the searchdata parameter in the search-vehicle.php page, causing the application to execute unintended SQL commands, leading to extraction of sensitive data from the database." POC is publicly available, so note that. Attack vector is network, requires authentication.
• exploitation_conditions: Need specific conditions from description. It says "unknown processing of the file /admin/search-vehicle.php. The manipulation of the argument searchdata leads to sql injection." So exploitation requires access to /admin/search-vehicle.php, which implies an authenticated session (admin), as the path is /admin/. Also low privileges required per CVSS vector (PR:L). So condition: "Requires authentication to the administrative panel of PHPGurukul Vehicle Parking Management System, and access to the search-vehicle functionality. The vulnerability is present in default deployments without input sanitization on the searchdata parameter." So I'll write: "The vulnerable endpoint /admin/search-vehicle.php is only accessible after authentication; therefore an attacker must have valid credentials (low-privilege admin) to exploit. No other special configuration is needed—the flaw exists in the default code handling the searchdata parameter." So limiting factor: authentication.
• attack_chain: Steps: 1) Gain low-privilege admin access to the vehicle parking management system (e.g., default credentials or credential theft). 2) Send a crafted HTTP request to /admin/search-vehicle.php with searchdata containing SQL injection payload. 3) The back-end PHP script concatenates the payload into an SQL query without sanitization. 4) The database executes the malicious SQL, returning manipulated results or exfiltrating data. So chain: "Obtain low-privilege admin credentials → Access /admin/search-vehicle.php → Inject SQL payload via searchdata parameter → Manipulate database queries → Exfiltrate or modify data." Use arrow notation. So: "Authenticate to admin panel → Craft malicious searchdata payload → Inject SQL query via search-vehicle.php → Database executes malicious query → Extract sensitive data." That's 5 steps.
• confidence_notes: "NVD confirmed the vulnerability with CVSS 4.0 vector and CWE-74. The exploit is publicly available on GitHub. No CISA KEV listing, and no vendor advisory found. Affected product version is exactly 1.13 per CPE; other versions unknown. Authenticated requirement inferred from CVSS vector PR:L." So: "Confirmed: vulnerability exists per NVD and VulDB; public exploit available. Inferred: authentication required from CVSS PR:L. Unknown: whether other versions are affected, and if a vendor patch exists."
• prevalence: PHPGurukul's Vehicle Parking Management System is a niche PHP project from a small vendor, likely not widely deployed. It's not a major enterprise product. So prevalence: low. Justification: "small-scale PHP application, niche parking management system."
• prevalence_basis: "niche parking management software from a small developer" (max 12 words). "niche PHP parking management software, limited installations."
• assessed_cvss_vector: Based on description and conditions, I'll provide a 3.1 vector. AV:N since remote, AC:L because SQL injection usually low complexity, PR:L (authenticated low-privilege), UI:N, S:C? No scope change? The SQL injection would impact the database, but likely no scope change. CVSS 4.0 had VC:L, VI:L, VA:L, SC:N. For 3.1: If no scope change, S:U, C:L/I:L/A:L. So vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. That's a base score 6.5? Actually low impact all, base score would be 4.3? Let me compute: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L gives score 4.3 (Medium). But NVD gave CVSS 4.0 score 2.1. But this is my independent assessment. I'll justify: "Low-privilege attack via network, no user interaction, low impact on confidentiality, integrity, availability; no scope change." So vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L". Rationale: "Requires low-privilege authentication (PR:L) but easy exploitation, limited impact on data."
• assessed_cvss40_vector: Convert to CVSS 4.0. Use AV:N, AC:L, AT:N, PR:L, UI:N, VC:L, VI