EUVD-2025-21347Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Impact | Despite the CVSS 7.3 score, this vulnerability presents CRITICAL real-world risk based on multiple corroborating signals: (1) Attack Vector is Network with no authentication required (PR:N) and low complexity (AC:L), making exploitation trivial; (2) Public exploit disclosure exists with proof-of-concept code available, dramatically increasing exploitation likelihood; (3) The vulnerability affects all three CIA triad components (Confidentiality:L, Integrity:L, Availability:L), though rated as low impact individually, SQL injection typically allows complete database compromise; (4) The nature of SQL injection in a web application context means this is highly automatable and requires minimal skill to exploit. While CVSS rates it 7.3, the EPSS score (if available) would likely be significantly elevated due to public POC availability and active exploitation. This should be treated as a Priority 1 vulnerability requiring immediate patching, not a 'wait and see' issue. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP request to the vulnerable application: GET /city.php?city=1' OR '1'='1 (or more sophisticated payloads like UNION-based or time-based blind SQL injection). The application concatenates this unsanitized input directly into a SQL query such as SELECT * FROM rooms WHERE city='1' OR '1'='1', which always evaluates to true. The attacker can extract sensitive data (usernames, passwords, room details), modify database records, or execute administrative operations depending on database permissions. With public POC availability, this can be automated and scaled across multiple targets. No user interaction (UI:N) is required, and the attack succeeds against any instance of AVL Rooms 1.0 accessible on the network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
CVE-2025-7606 is a critical SQL injection vulnerability in code-projects AVL Rooms 1.0 affecting the /city.php file, where the 'city' parameter is improperly sanitized, allowing remote unauthenticated attackers to execute arbitrary SQL queries. The vulnerability has a CVSS score of 7.3 (High) with confirmed public exploit disclosure and active exploitation potential, enabling attackers to read, modify, or delete database contents without authentication.
RemediationAI
{'type': 'Patch', 'description': 'Upgrade to a patched version of AVL Rooms if available from code-projects. Check vendor advisory for specific patch version (information not provided in CVE data; contact vendor directly).'} {'type': 'Immediate Mitigation (if patching unavailable)', 'steps': ["Implement input validation: Whitelist allowed characters for the 'city' parameter (alphanumeric, spaces, hyphens only)", 'Use parameterized queries/prepared statements in /city.php to separate SQL code from data: use mysqli_prepare() or PDO prepared statements instead of string concatenation', 'Apply output encoding to prevent second-order SQL injection', "Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the 'city' parameter", 'Run queries with minimal necessary database privileges (principle of least privilege)', 'Enable SQL error suppression to prevent information disclosure']} {'type': 'Detection', 'steps': ['Monitor application logs for SQL error messages and unusual database queries', 'Implement IDS/IPS signatures for SQL injection attacks targeting /city.php', 'Review database access logs for unexpected query patterns']}
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), a direct subcategory of injection flaws. The root cause is insufficient input validation and output encoding in the PHP application's /city.php file, where user-supplied input from the 'city' parameter is concatenated directly into SQL queries without parameterized queries or prepared statements. The affected product is code-projects AVL Rooms version 1.0, a PHP-based web application (CPE: cpe:2.3:a:code-projects:avl_rooms:1.0:*:*:*:*:*:*:*). The vulnerability exploits typical SQL injection patterns where special characters and SQL syntax are passed through unsanitized HTTP parameters to manipulate backend database logic.
Know when Avl Rooms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability classified as critical has been found in code-projects AVL Rooms 1.0. This affects an unknown part of the file /city.php. The manipulation of the argument city leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
AVL Rooms 1.0 contains a critical SQL injection vulnerability in the /city.php file that allows unauthenticated remote attackers to compromise database integrity and potentially access sensitive data. With public exploit code available and no vendor patch currently available, this poses an immediate risk to any organization running this application in production.
- Deploy WAF rules to filter SQL injection patterns in the 'city' parameter; 2) Implement strict input validation and parameterized queries in the application code; 3) Restrict network access to /city.php endpoint via IP whitelisting; 4) Disable the AVL Rooms application until a patch is available; 5) Monitor database logs for suspicious SQL queries; 6) Run the application behind a reverse proxy with input sanitization rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB