Which versions of PHP are affected by CVE-2025-7515?

A SQL injection vulnerability in the Online Appointment Booking System 1.0 allows unauthenticated remote attackers to compromise the database through the doctor name input field.

Is there a public PoC exploit available for CVE-2025-7515?

Yes, a public proof-of-concept exploit is available for CVE-2025-7515. Prioritise patching immediately. EPSS: 0.1%.

PHP CVE-2025-7515

Q: What is the CVSS score of CVE-2025-7515?

CVE-2025-7515 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

Q: How to fix or mitigate CVE-2025-7515?

Within 24 hours: Identify all systems running Online Appointment Booking System 1.0 and assess exposure; disable the /ulocateus.php endpoint or restrict access via network controls. Within 7 days: Implement WAF rules to block SQL injection patterns in the doctorname parameter; conduct database audit for unauthorized access. Within 30 days: Migrate to patched version when available or replace with alternative vendor solution; review database access logs and implement quarterly SQL injection testing.

EUVD-2025-21246 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-13 cna@vuldb.com

PHP SQLi Online Appointment Booking System Anisha

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 09:18 euvd

EUVD-2025-21246

Analysis Generated

Mar 16, 2026 - 09:18 vuln.today

PoC Detected

Jul 15, 2025 - 17:40 vuln.today

Public exploit code

CVE Published

Jul 13, 2025 - 04:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability classified as critical has been found in code-projects Online Appointment Booking System 1.0. This affects an unknown part of the file /ulocateus.php. The manipulation of the argument doctorname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7515 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /ulocateus.php file where the 'doctorname' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing real-world exploitation risk.

Technical ContextAI

The vulnerability exists in a PHP-based web application (code-projects Online Appointment Booking System 1.0) that likely uses a MySQL or similar relational database backend. The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), manifesting as SQL injection. The /ulocateus.php endpoint accepts user-supplied input via the 'doctorname' parameter without proper parameterized queries, prepared statements, or input validation/sanitization. This allows attackers to inject SQL metacharacters and malicious SQL commands into database queries. The affected CPE would be: cpe:2.3:a:code-projects:online_appointment_booking_system:1.0:*:*:*:*:*:*:*

RemediationAI

{'type': 'Patching', 'description': 'Upgrade to a patched version >1.0 if available from code-projects. No specific patch version identified in available intelligence; contact vendor directly or monitor security advisories.'} {'type': 'Immediate Mitigation (if patching unavailable)', 'steps': ["Implement Web Application Firewall (WAF) rules to block SQL injection patterns in the 'doctorname' parameter (e.g., detect single quotes, SQL keywords like UNION, SELECT, DROP)", 'Disable or restrict access to /ulocateus.php if not critical to operations', 'Implement rate limiting and IP-based access controls to the vulnerable endpoint']} {'type': 'Code-Level Fix (if in-house deployment)', 'steps': ['Replace all string concatenation in SQL queries with parameterized prepared statements (e.g., mysqli_prepare() or PDO prepared statements in PHP)', "Implement input validation: whitelist allowed characters for 'doctorname' (alphanumeric, spaces, hyphens only)", 'Apply output encoding for any database results displayed to users', 'Conduct full code review of /ulocateus.php and related database interaction code']} {'type': 'Detection', 'steps': ['Monitor database query logs for unusual SQL patterns or errors originating from /ulocateus.php', 'Enable SQL error logging and alerting', "Review web server access logs for suspicious characters in 'doctorname' parameter (encoded quotes, SQL keywords)"]}