Which versions of PHP are affected by CVE-2025-7540?

A critical SQL injection vulnerability exists in the Online Appointment Booking System 1.0 that allows unauthenticated remote attackers to compromise the database.

Is there a public PoC exploit available for CVE-2025-7540?

Yes, a public proof-of-concept exploit is available for CVE-2025-7540. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-7540?

Within 24 hours: Identify all systems running Online Appointment Booking System 1.0 and isolate them from production networks or disable public access. Within 7 days: Implement WAF rules to block SQL injection patterns targeting /getcliclinic.php and monitor for exploitation attempts. Within 30 days: Migrate to a patched version when available, or decommission the application and transition to a vendor-supported appointment booking solution.

PHP CVE-2025-7540

Q: What is the CVSS score of CVE-2025-7540?

CVE-2025-7540 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-21268 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-13 cna@vuldb.com

PHP SQLi Online Appointment Booking System Anisha

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 09:18 euvd

EUVD-2025-21268

Analysis Generated

Mar 16, 2026 - 09:18 vuln.today

PoC Detected

Jul 16, 2025 - 14:53 vuln.today

Public exploit code

CVE Published

Jul 13, 2025 - 20:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability, which was classified as critical, was found in code-projects Online Appointment Booking System 1.0. Affected is an unknown function of the file /getclinic.php. The manipulation of the argument townid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

AnalysisAI

CVE-2025-7540 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System 1.0 affecting the /getclinic.php file's townid parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the database. The vulnerability has been publicly disclosed with exploit code available, creating immediate operational risk for deployed instances.

Technical ContextAI

The vulnerability exists in the Online Appointment Booking System (a PHP-based web application), specifically in the /getclinic.php endpoint which likely queries clinic data filtered by geographic location (townid parameter). The root cause is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), indicating insufficient input validation/sanitization before SQL query construction. The townid parameter is passed directly into SQL statements without prepared statements or parameterized queries. This is a classic second-order SQL injection or direct SQL injection scenario where user input flows unsanitized into database queries. PHP applications using mysqli or PDO without proper prepared statement usage are particularly susceptible.

RemediationAI

IMMEDIATE: Apply input validation and sanitization to the townid parameter—implement allowlist validation (e.g., numeric-only if townid should be numeric) before SQL usage. 2) PRIMARY FIX: Refactor /getclinic.php to use parameterized queries/prepared statements with bound parameters (mysqli prepared statements or PDO prepared statements) instead of string concatenation for SQL construction. 3) Update to the latest patched version of Online Appointment Booking System once released by code-projects. 4) SHORT-TERM MITIGATION: Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the townid parameter (e.g., block payloads containing SQL keywords: UNION, SELECT, OR 1=1). 5) Apply principle of least privilege to database user credentials used by the application. 6) No vendor advisory URL was provided; check code-projects official repository or security advisories for patch availability. 7) Conduct code review of all similar parameter handling throughout the application.