Which versions of PHP are affected by CVE-2025-7533?

A critical SQL injection vulnerability in Job Diary 1.0 allows unauthenticated remote attackers to compromise database integrity and extract sensitive data.

Is there a public PoC exploit available for CVE-2025-7533?

Yes, a public proof-of-concept exploit is available for CVE-2025-7533. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-7533?

Within 24 hours: Isolate affected Job Diary 1.0 instances from production networks or disable public access; inventory all deployments and affected users. Within 7 days: Deploy WAF rules to block malicious job_id parameters in /view-details.php requests; implement input validation and parameterized queries if source code access available. Within 30 days: Evaluate alternative job management solutions or contact vendor for patched version availability; migrate critical data to patched environment once available.

PHP CVE-2025-7533

Q: What is the CVSS score of CVE-2025-7533?

CVE-2025-7533 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-21262 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-13 cna@vuldb.com

PHP SQLi Job Diary Anisha

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 09:18 euvd

EUVD-2025-21262

Analysis Generated

Mar 16, 2026 - 09:18 vuln.today

PoC Detected

Jul 16, 2025 - 14:55 vuln.today

Public exploit code

CVE Published

Jul 13, 2025 - 17:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Job Diary 1.0 and classified as critical. This issue affects some unknown processing of the file /view-details.php. The manipulation of the argument job_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7533 is a SQL injection vulnerability in code-projects Job Diary 1.0 affecting the /view-details.php file through the job_id parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially read, modify, or delete database contents. The vulnerability has a CVSS score of 7.3 (High) with public exploit disclosure and proof-of-concept availability, indicating active exploitation risk in the wild. This is a critical severity issue for all deployments of the affected version with direct database access implications.

Technical ContextAI

The vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), specifically SQL injection within a PHP-based web application. The /view-details.php endpoint fails to properly sanitize or parameterize the job_id parameter before using it in SQL queries, allowing attackers to inject malicious SQL syntax. This is a classic input validation failure where user-controlled data is concatenated directly into SQL statements without prepared statements or input escaping. The affected product is code-projects Job Diary version 1.0, a PHP-based job management application that likely stores job records in a SQL database (MySQL/MariaDB typical for PHP applications). The lack of prepared statement usage or input validation on a commonly-used identifier parameter (job_id) suggests the application was developed without security-first practices.

RemediationAI

Immediate actions: (1) PATCH: Upgrade to a patched version if available from code-projects; check vendor repository/website for security updates beyond 1.0 (no specific patch version identified in current intelligence - urgent vendor contact required); (2) WORKAROUND: Implement Web Application Firewall (WAF) rules blocking SQL injection patterns in job_id parameter (e.g., block single quotes, SQL keywords like UNION, OR 1=1, comment syntax); (3) MITIGATION: Restrict network access to /view-details.php via IP allowlisting or require authentication at network/application layer; (4) DETECTION: Monitor database query logs for unusual SQL patterns; enable SQL error logging to catch injection attempts; (5) CODE FIX (interim): Modify /view-details.php to use prepared statements with parameterized queries instead of string concatenation - replace any code using sprintf() or string concatenation with mysqli_prepare() or PDO prepared statements. Example: Use $stmt = $mysqli->prepare('SELECT * FROM jobs WHERE job_id = ?'); $stmt->bind_param('i', $job_id); instead of $query = 'SELECT * FROM jobs WHERE job_id = ' . $_GET['job_id'];