Which versions of PHP are affected by CVE-2025-7610?

A critical SQL injection vulnerability in the Electricity Billing System password change function allows unauthenticated remote attackers to compromise user accounts and extract sensitive billing…

Is there a public PoC exploit available for CVE-2025-7610?

Yes, a public proof-of-concept exploit is available for CVE-2025-7610. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-7610?

Within 24 hours: Isolate affected systems from production if possible; enable enhanced logging on the /user/change_password.php endpoint; scan logs for exploit attempts. Within 7 days: Deploy WAF rules to block SQL injection patterns in the new_password parameter; implement IP whitelisting for password change requests; notify affected users to monitor accounts. Within 30 days: Evaluate alternative billing systems; if retention is necessary, commission a code review and custom patch from the vendor or security firm; implement database access controls to limit damage from SQL injection.

PHP CVE-2025-7610

Q: What is the CVSS score of CVE-2025-7610?

CVE-2025-7610 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-21353 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-14 cna@vuldb.com

PHP SQLi Electricity Billing System Anisha

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 09:43 euvd

EUVD-2025-21353

Analysis Generated

Mar 16, 2026 - 09:43 vuln.today

PoC Detected

Sep 29, 2025 - 21:16 vuln.today

Public exploit code

CVE Published

Jul 14, 2025 - 14:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Electricity Billing System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /user/change_password.php. The manipulation of the argument new_password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7610 is a critical SQL injection vulnerability in code-projects Electricity Billing System 1.0 affecting the password change functionality at /user/change_password.php. An unauthenticated remote attacker can inject arbitrary SQL commands through the new_password parameter to read, modify, or delete database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation highly probable.

Technical ContextAI

This vulnerability is a classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements used in an SQL Command) in a PHP-based web application. The root cause is insufficient input validation and parameterized query usage in the password change function. The new_password parameter is concatenated directly into SQL queries without proper escaping or prepared statement usage. The affected application is code-projects Electricity Billing System, a PHP-based billing management solution commonly deployed in small-to-medium enterprises. The vulnerable file /user/change_password.php processes user input without sanitization, allowing attackers to break out of the intended SQL context and execute arbitrary commands against the backend database (typically MySQL/MariaDB).

RemediationAI

Immediate actions: (1) Apply input validation to reject SQL metacharacters in password fields or implement strict allowlists (alphanumeric + symbols only), (2) Use parameterized queries/prepared statements with bound parameters in the password update query, (3) Implement WAF rules to detect and block SQL injection payloads in the new_password parameter. Long-term: Update to a patched version when released by code-projects (monitor their GitHub or advisory channels for v1.1+). Workaround: Temporarily disable the /user/change_password.php endpoint or restrict access via IP whitelisting/authentication middleware until patching is feasible. Database-level: Implement principle-of-least-privilege on the database user account used by the application (remove DROP, ALTER, FILE privileges).