EUVD-2025-21352Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Impact | CVSS 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates medium-high severity with broad attack surface: network-accessible, requires no privileges, no user interaction, and impacts confidentiality, integrity, and availability. The 'L' impact ratings understate actual risk—SQL injection typically allows complete database compromise, not just limited impact. Critical risk factors: (1) Public disclosure with available POC dramatically increases exploitation probability; (2) No authentication required (PR:N) means any unauthenticated attacker can attempt exploitation; (3) Low attack complexity makes weaponization trivial; (4) Wedding Reservation is likely deployed on exposed web servers with direct internet access. This is a genuine, immediately exploitable vulnerability requiring urgent patching, not a theoretical high-CVSS-low-risk scenario. SSVC factors: Exploitation is PUBLIC, likely AUTOMATABLE via standard SQLi payloads, and provides COMPLETE technical impact (database compromise). Priority: CRITICAL. |
| Exploit ScenarioDerived | An attacker discovers a publicly exposed Wedding Reservation 1.0 instance via search engine or network scanning. They craft a malicious HTTP request with SQL injection payload in the 'lu' parameter (e.g., GET /global.php?lu=1' UNION SELECT username, password FROM users--). Due to AC:L and PR:N, the attack succeeds without authentication or user interaction. The attacker extracts customer data (names, contact info, payment details), modifies reservation records, or deletes data entirely. Exploitation is likely automated via tools like SQLmap. Timeline: discovery-to-exploitation can occur within hours of disclosure. No special tools or specialized knowledge required beyond standard SQL injection techniques. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
CVE-2025-7611 is a critical SQL injection vulnerability in code-projects Wedding Reservation version 1.0, affecting the /global.php file's 'lu' parameter. Remote unauthenticated attackers can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, significantly increasing real-world exploitation risk.
RemediationAI
Immediate actions: (1) Identify all instances of Wedding Reservation 1.0 in production and take offline if possible or restrict network access; (2) Apply vendor patches if available (check code-projects repository or official advisories for patched versions); (3) If patches unavailable, implement Web Application Firewall (WAF) rules to block SQL injection payloads in the 'lu' parameter (common patterns: UNION, SELECT, OR 1=1, SLEEP(), BENCHMARK()); (4) Force parameterized queries/prepared statements in /global.php for all database interactions; (5) Conduct emergency code review of global.php and similar entry points; (6) Implement input validation (whitelist allowed characters for 'lu') and output encoding; (7) Monitor database logs for suspicious queries. Long-term: upgrade to a maintained reservation system or require immediate vendor security updates before continued use.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which manifests as SQL injection through insufficient input validation/sanitization. The /global.php file in Wedding Reservation 1.0 fails to properly escape or parameterize the 'lu' parameter before incorporating it into SQL queries. The attack vector is network-based with no authentication required (PR:N) and low attack complexity (AC:L), meaning standard SQL injection techniques (UNION-based, time-based blind, or error-based) are likely viable. The affected product is code-projects Wedding Reservation version 1.0, a web-based reservation management application written in PHP.
Know when Wedding Reservation gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in code-projects Wedding Reservation 1.0. It has been classified as critical. This affects an unknown part of the file /global.php. The manipulation of the argument lu leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
A publicly disclosed SQL injection vulnerability in Wedding Reservation 1.0 allows remote attackers to compromise database integrity and potentially access sensitive customer information. Organizations using this application face immediate risk of data theft, system compromise, and regulatory exposure, particularly if customer payment or personal data is stored.
Implement Web Application Firewall (WAF) rules to block SQL injection patterns in the 'lu' parameter; restrict network access to /global.php using IP allowlisting; disable the Wedding Reservation application if operationally feasible; apply database access controls with least-privilege accounts; enable comprehensive logging and real-time alerting for suspicious SQL queries; consider network segmentation to isolate the vulnerable application from sensitive systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB