Which versions of PHP are affected by CVE-2025-7612?

A critical SQL injection vulnerability in Mobile Shop 1.0's login function allows unauthenticated attackers to remotely compromise the application and access sensitive data.

Is there a public PoC exploit available for CVE-2025-7612?

Yes, a public proof-of-concept exploit is available for CVE-2025-7612. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-7612?

Within 24 hours: Isolate affected Mobile Shop 1.0 instances from production if possible; enable enhanced logging on login endpoints; notify stakeholders and customers of potential exposure. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns in the email parameter; implement input validation and parameterized queries if code-level fixes can be applied internally; conduct forensic analysis for evidence of exploitation. Within 30 days: Upgrade to patched version immediately upon availability; perform full security assessment of application; reset user credentials and audit access logs for suspicious activity.

PHP CVE-2025-7612

Q: What is the CVSS score of CVE-2025-7612?

CVE-2025-7612 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-21359 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-14 cna@vuldb.com

PHP SQLi Mobile Shop Anisha

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 09:43 euvd

EUVD-2025-21359

Analysis Generated

Mar 16, 2026 - 09:43 vuln.today

PoC Detected

Jul 15, 2025 - 17:07 vuln.today

Public exploit code

CVE Published

Jul 14, 2025 - 15:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Mobile Shop 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7612 is a critical SQL injection vulnerability in code-projects Mobile Shop 1.0 affecting the /login.php file's email parameter, allowing remote unauthenticated attackers to execute arbitrary SQL queries and potentially extract or modify sensitive data. The vulnerability has been publicly disclosed with exploit code available, making it actively exploitable in the wild. With a CVSS score of 7.3 and demonstrated public PoC availability, this represents an immediate threat to deployments of this product.

Technical ContextAI

The vulnerability exists in the authentication mechanism of Mobile Shop 1.0, specifically within /login.php where user-supplied input via the 'email' parameter is insufficiently sanitized before being incorporated into SQL queries. This classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component) allows attackers to break out of intended SQL syntax and inject malicious commands. The affected component is the login authentication layer, typically responsible for credential verification. Without proper parameterized queries or input validation, attackers can manipulate the email parameter to alter query logic, bypass authentication controls, or extract database contents. CPE designation would be: cpe:2.3:a:code-projects:mobile_shop:1.0:*:*:*:*:*:*:*

RemediationAI

Immediate actions: (1) Patch/Update: Check code-projects project repository or vendor advisories for patched versions beyond 1.0 (likelihood low if abandoned); if unavailable, perform in-house remediation; (2) Input Validation: Implement strict email format validation using regex or built-in validators, rejecting inputs containing SQL metacharacters; (3) Parameterized Queries: Replace all string concatenation in SQL queries with prepared statements/parameterized queries for the email parameter and all user inputs; (4) Escape Special Characters: If parameterized queries are unavailable, apply database-specific escaping functions (e.g., mysqli_real_escape_string for MySQL); (5) WAF/IPS: Deploy Web Application Firewall rules to detect and block SQL injection patterns in login requests (signatures targeting UNION, SELECT, OR 1=1, etc.); (6) Database Permissions: Apply principle of least privilege—limit login.php database user account to SELECT-only on authentication tables, preventing INSERT/UPDATE/DELETE exploitation; (7) Monitoring: Implement logging and alerting on unusual SQL query patterns or authentication failures; (8) Consider Migration: Evaluate migration to a maintained alternative if code-projects Mobile Shop is no longer actively supported. No official vendor patches are currently available in references.