PHP CVE-2025-7520

We need to produce a JSON object with all required fields. I'll parse the CVE data and synthesize.

CVE-2025-7520: PHPGurukul Vehicle Parking Management System 1.13, SQL injection in /admin/manage-category.php via 'del' parameter. CVSS 4.0 vector given: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. This indicates low privileges needed (PR:L), low impact on confidentiality, integrity, availability. Exploit publicly available. EPSS score 0.06%, percentile 20% (low). CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') but typically SQL injection would be CWE-89; but the given is CWE-74, maybe broader). Tags: PHP, SQLi. Patch: Not mentioned. KEV: Not mentioned. So no active exploitation, only POC publicly available.

Product: Vehicle Parking Management System 1.13, vendor PHPGurukul. The CPE is cpe:2.3:a:phpgurukul:vehicle_parking_management_system:1.13:*:*:*:*:*:*:*

Now we need to produce a JSON. I'll craft each field.

product_name: "Vehicle Parking Management System" (3 words, specific product). The description: "PHPGurukul Vehicle Parking Management System 1.13". So product_name = "Vehicle Parking Management System". Or maybe "PHPGurukul Vehicle Parking Management System" is the full product name, but rule says "1-3 words ONLY. The specific product or service name affected." So I'll use "Vehicle Parking Management System". That's the core name. Could also be "PHPGurukul Vehicle Parking Management System" but that's 4 words. I'll trim to "Vehicle Parking Management System". Vendor not alone, product not type. So okay.

summary: Start with impact verb and product. "SQL injection in Vehicle Parking Management System 1.13 allows..." Need a summary synthesizing all data: Critical classification but CVSS 4.0 shows low impact (VI:L, VC:L, VA:L) and low privileges, exploit public. No KEV. EPSS low. So summary: "SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows remote authenticated attackers with low privileges to manipulate the 'del' parameter in /admin/manage-category.php, potentially reading, modifying, or deleting data. Public exploit code exists but exploitation probability is low (EPSS 0.06%) and no active exploitation reported." Must avoid copying description. Start with "SQL injection in Vehicle Parking Management System 1.13 allows..." Include that it's authenticated (PR:L). Impact is low (confidentiality, integrity, availability all low). So summary: "SQL injection in Vehicle Parking Management System 1.13 allows authenticated remote attackers with low privileges to execute arbitrary SQL commands via the 'del' parameter in /admin/manage-category.php, leading to potential data manipulation or disclosure. Public proof-of-concept exploit code is available, but no active exploitation has been confirmed, and EPSS score of 0.06% suggests low real-world exploitation probability." Good.

technical_context: Explain underlying technology: PHP application, SQL injection via parameter not sanitized. CWE-74 is injection, likely parameter not properly escaped. CPE indicates exact product. So "The vulnerability affects PHPGurukul Vehicle Parking Management System 1.13, a PHP-based application. The affected file /admin/manage-category.php passes user-supplied 'del' argument directly to a SQL query without proper sanitization, leading to CWE-74 injection. This allows attacker-supplied SQL statements to alter the query logic."

risk_assessment: Use all signals. CVSS vector: AV:N, AC:L, AT:N, PR:L, UI:N, VC:L, VI:L, VA:L, SC:N, SI:N, SA:N, E:P. So network exploitable, low complexity, low privileges, no user interaction, low impact on all three, no scope change. EPSS 0.06% (20th percentile) very low exploitation probability. Exploit public (E:P). KEV not present. So risk is low despite critical classification. I'll compare: CVSS base score not given but from vector, using CVSS 4.0 calculator: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N gives base score of 5.3 (Medium). CVSS 4.0 base score = 5.3? Actually compute: Base Score = based on impact sub-score and exploitability. Using CVSS 4.0 formula: Exploitability = [8.22 * AV * AC * AT * PR * UI], but easier: According to CVSS v4.0 spec, with AV:N(0), AC:L(0), AT:N(0), PR:L(0.2), UI:N(0) -> Exploitability = 8.22 * AV(1) * AC(1) * AT(1) * PR(1-0.2=0.8) * UI(1) = 8.22 * 1 * 1 * 1 * 0.8 * 1 = 6.576. Impact subscore: ISS = VC*L(1) + VI*L(1) + VA*L(1) = 3; but need modify with SC,SI,SA all N so system impact? Actually impact: VC:1 (Low) weight 0.95? The spec says for low change: VC=0.95? I'll compute quickly: CVSS v4.0 base score steps: ISS = 1 - [(1 - VC) * (1 - VI) * (1 - VA)] if scope unchanged. Here VC = 1 (Low) -> 0.95, VI = 1 (Low) -> 0.95, VA = 1 (Low) -> 0.95. Then 1 - (0.05 * 0.05 * 0.05) = 1 - 0.000125 = 0.999875. Then impact = 1 - ISS = 0.000125, but that's not right. Actually the impact subscore (ISS) = 1 - [(1 - VC) * (1 - VI) * (1 - VA)] = 1 - (1-0.95)^3 = 1 - 0.000125 = 0.999875. Then impact = (1 - ISS) if not modified? Wait base score formula: if scope unchanged, Impact = ISS, so Impact = 0.999875. Then Base Score = if Impact <= 0 then 0, else [roundup(min( (Exploitability + Impact), 10 ) ))]? Yes, Base Score = min( (Exploitability + Impact), 10 ). So 6.576 + 0.999875 = 7.575875, rounded up 7.6. So base score 7.6 High. That's different from low impact; CVSS 4.0 with all lows but high exploitability yields 7.6. So despite low individual impacts, the base score is high. So classification "critical" from VulDB might be based on that. But then EPSS low. So risk assessment: CVSS 4.0 base score 7.6 (High) but low EPSS and no active exploitation. Privileges are low, so authenticated. So real priority: moderate, because exploit is public but exploitation requires authentication, EPSS low. I'll write: "CVSS 4.0 base score is 7.6 (High), driven by network accessibility, low attack complexity, and low privileges, though individual confidentiality, integrity, and availability impacts are assessed as Low. EPSS exploitation probability is only 0.06% (20th percentile), indicating very low real-world exploitation likelihood. No evidence of active exploitation in the wild, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Given that a public proof-of-concept exists but exploitation requires valid credentials (low-privilege user) and no observed scanning activity, overall risk is moderate—the high CVSS is tempered by low real-world threat activity and limited impact per successful exploit. The critical classification from the reporter may overstate practical risk." Include note about authentication: PR:L, so "the attacker must be authenticated with low privileges". Also note that CVSS vector indicates network attack vector, which aligns. So risk is not critical but High CVSS score.

affected_products: "PHPGurukul Vehicle Parking Management System version 1.13 (cpe:2.3:a:phpgurukul:vehicle_parking_management_system:1.13:*:*:*:*:*:*:*) as confirmed by NVD and ENISA EUVD. The vendor advisory is available at https://phpgurukul.com/ and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-7520."

remediation: Patch status? No fix version given in data. The patch may not be available. So I'll state: "No vendor-released patch identified at time of analysis. The vendor, PHPGurukul, has not announced a fixed version. As a workaround, administrators should restrict access to the /admin/manage-category.php endpoint to only highly trusted users, input validation or parameterized queries can be implemented manually, or disable the affected feature if feasible. However, manual code fixes may introduce risk of regression. Monitor the vendor's website (https://phpgurukul.com/) and the NVD entry for updates." No exact version. No compensating controls for SQL injection? Could recommend using a WAF to filter SQL injection attempts as a temporary measure, but primary is patch. I'll say: "Until a patch is released, apply a Web Application Firewall rule to block SQL injection patterns targeting the 'del' parameter, restrict administrative panel access via IP whitelisting or strong authentication, and consider removing the management interface from public exposure. The download location is https://phpgurukul.com/, but no new version has been confirmed safe."

exploit_scenario: "An attacker who obtains low-privilege credentials (e.g., via phishing or weak passwords) logs into the application, navigates to /admin/manage-category.php, and sends a crafted 'del' parameter containing SQL injection payload. This modifies the query to exfiltrate data from the database, modify entries, or potentially delete records." Factor in public exploit.

exploitation_conditions: "The attacker must have valid low-privilege credentials to access the administrative panel and the /admin/manage-category.php endpoint. The 'del' parameter is directly vulnerable without any additional configuration. The attack is performed remotely via HTTP. No special features need to be enabled; the endpoint is part of the default installation of Vehicle Parking Management System 1.13." Do not use generic phrases: I'll specify "no additional configuration required beyond a default install and low-privilege authenticated access to the admin interface." That's concrete.

attack_chain: Steps: "Obtain valid low-privilege credentials for admin panel → Access /admin/manage-category.php endpoint → Send HTTP request with malicious SQL payload in 'del' parameter → SQL database executes injected commands → Extract, modify, or delete data from the database." That's 5 steps. Good.

confidence_notes: "Vulnerability confirmed by NVD/CVE record and ENISA EUVD advisory. Public exploit code available in GitHub repository (https://github.com/f1rstb100d/myCVE/issues/121). No patch version confirmed; vendor did not yet release a fix. No evidence of active exploitation. CVSS vector from VulDB indicates low privileges (PR:L) and low impacts, consistent with SQL injection in an admin parameter." So I'll state: "Confirmed by NVD, ENISA, and VulDB. Exploit code is public but no active exploitation in CISA KEV. Patch availability unconfirmed—vendor site has no advisory. CVSS vector appears from VulDB; impacts rated Low."

prevalence: "low". Reasoning: "Vehicle Parking Management System" is a niche PHP application from a small vendor, likely not widely deployed. The prevalence basis: "niche parking management application with limited known adoption."

prevalence_basis: "niche PHP application, minimal enterprise deployment" (max 12 words). So "niche PHP application, minimal enterprise deployment."

assessed_cvss_vector: My independent CVSS 3.1 vector based on description. The attack vector is Network, complexity Low, privileges required Low (authenticated user), no user interaction, scope Unchanged (no scope change), confidentiality low, integrity low, availability low. So CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. That yields base score 6.3 (Medium). The given CVSS 4.0 had PR:L,