EUVD-2025-21347Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability classified as critical has been found in code-projects AVL Rooms 1.0. This affects an unknown part of the file /city.php. The manipulation of the argument city leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
CVE-2025-7606 is a critical SQL injection vulnerability in code-projects AVL Rooms 1.0 affecting the /city.php file, where the 'city' parameter is improperly sanitized, allowing remote unauthenticated attackers to execute arbitrary SQL queries. The vulnerability has a CVSS score of 7.3 (High) with confirmed public exploit disclosure and active exploitation potential, enabling attackers to read, modify, or delete database contents without authentication.
Technical ContextAI
This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), a direct subcategory of injection flaws. The root cause is insufficient input validation and output encoding in the PHP application's /city.php file, where user-supplied input from the 'city' parameter is concatenated directly into SQL queries without parameterized queries or prepared statements. The affected product is code-projects AVL Rooms version 1.0, a PHP-based web application (CPE: cpe:2.3:a:code-projects:avl_rooms:1.0:*:*:*:*:*:*:*). The vulnerability exploits typical SQL injection patterns where special characters and SQL syntax are passed through unsanitized HTTP parameters to manipulate backend database logic.
RemediationAI
{'type': 'Patch', 'description': 'Upgrade to a patched version of AVL Rooms if available from code-projects. Check vendor advisory for specific patch version (information not provided in CVE data; contact vendor directly).'} {'type': 'Immediate Mitigation (if patching unavailable)', 'steps': ["Implement input validation: Whitelist allowed characters for the 'city' parameter (alphanumeric, spaces, hyphens only)", 'Use parameterized queries/prepared statements in /city.php to separate SQL code from data: use mysqli_prepare() or PDO prepared statements instead of string concatenation', 'Apply output encoding to prevent second-order SQL injection', "Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the 'city' parameter", 'Run queries with minimal necessary database privileges (principle of least privilege)', 'Enable SQL error suppression to prevent information disclosure']} {'type': 'Detection', 'steps': ['Monitor application logs for SQL error messages and unusual database queries', 'Implement IDS/IPS signatures for SQL injection attacks targeting /city.php', 'Review database access logs for unexpected query patterns']}
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today