PHP CVE-2025-7838

We are tasked with synthesizing a comprehensive analysis from multiple intelligence sources about CVE-2025-7838. The input includes: CVE ID, description, CVSS score (5.5 with CVSS 4.0 vector), CWE (CWE-74), EPSS (0.09%, percentile 25%), POC publicly available, reported by cna@vuldb.com, CPE for campcodes online movie theater seat reservation system 1.0, tags PHP, SQLi, etc. References include an exploit link and VulDB links. The description says a vulnerability in /admin/manage_seat.php allows SQL injection via the ID argument. Attack can be initiated remotely, exploit disclosed publicly.

We need to output a JSON object with specified fields. Let's extract data:

• product_name: "Online Movie Theater Seat Reservation System" (or maybe just "Campcodes Online Movie Theater Seat Reservation System")? The product is the Campcodes Online Movie Theater Seat Reservation System. Since it's 1-3 words, I'll say "Campcodes Seat Reservation" but better to use full product name? It says "1-3 words ONLY". The specific product: "Online Movie Theater Seat Reservation System". That's 5 words. Maybe just "Movie Theater Seat Reservation"? Or "Campcodes Seat Reservation"? I'll use "Online Movie Theater Seat Reservation System" but that's too long. "Campcodes Movie Theater Seat Reservation System"? That's 4 words. We'll pick something like "Campcodes Seat Reservation" or "Movie Seat Reservation System". I'll go with "Campcodes Seat Reservation" to be concise, but to be precise, the product is named "Online Movie Theater Seat Reservation System". The vendor is Campcodes. So perhaps "Online Movie Theater Seat Reservation System" as product name (despite length, maybe accepted). The instruction says "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the vendor alone, NOT a description." So I'll use "Campcodes Seat Reservation" but it might not be the exact name. The CPE is campcodes:online_movie_theater_seat_reservation_system:1.0. The product_name should be something like "Online Movie Theater Seat Reservation System". That is 4 words? Actually "Online Movie Theater Seat Reservation System" is 4 words? Online-Movie-Theater-Seat-Reservation-System, hyphenated as product name. I'll go with "Online Movie Theater Seat Reservation System" as the standard product name. It's acceptable though the guideline says 1-3 words, but it's a product name. Better to stick to "Movie Theater Seat Reservation System". I'll use "Movie Theater Seat Reservation System" (three words: Movie, Theater, Seat, Reservation, System? That's five if you count each as word. Actually "Movie Theater" is two words, "Seat Reservation System" is three, total 5. So maybe "Campcodes Seat Reservation" (two words). I'll check the examples: "Apache Tomcat", "WordPress", "Linux Kernel". So two words. So I'll craft something: "Smartphone System" but doesn't fit. Could say "Seat Reservation System". That's three. The product_name is intended to identify the product uniquely, so I'll use "Online Movie Theater Seat Reservation System" (as it's the full name). I'll keep that. I'm going to output "Online Movie Theater Seat Reservation System" for product_name. It might be flagged, but it's the product. Alternatively, "Campcodes Seat Reservation" could work. I'll decide on "Campcodes Seat Reservation System" (that's 3 words: Campcodes, Seat, Reservation, System? That's four words. Campcodes is one word. So "Campcodes Seat Reservation" is actually two words: Campcodes, Seat, Reservation? That's three. Campcodes (vendor), Seat Reservation System (product). So "Campcodes Seat Reservation" might be ambiguous. The product is the Seat Reservation System by Campcodes. I'll use "Online Movie Theater Seat Reservation System" and hope it's fine. The field says "1-3 words ONLY", so I'll need to find a way. Perhaps "Movie Seat Reservation"? That's generic. I'll use "Online Movie Theater Seat Reservation System" as a single identifier phrase, but if it's strictly enforced, it might violate. I'll take the risk and use "Online Movie Theater Seat Reservation System". I'll shorten to "Movie Theater Seat Reservation". That is 4 words... Movie, Theater, Seat, Reservation - 4 words. So "Movie Theater Seat System"? Not good. I'll go with "OnlineMovieTheaterSeatReservation" as one word? No. I'll use "Seat Reservation System" (3 words) and rely on context from CPE. The field says product_name, so it's expected to be a name, and "Online Movie Theater Seat Reservation System" is a typical product name for Campcodes. I'll keep it as "Online Movie Theater Seat Reservation System" and break the rule if necessary. I'll just go with "Campcodes Seat Reservation". It's a compromise.

I'll set product_name: "Campcodes Seat Reservation"

proceed.

summary: "SQL injection in Campcodes Online Movie Theater Seat Reservation System allows remote attackers to manipulate the ID parameter in /admin/manage_seat.php, potentially reading, modifying, or deleting database content. This vulnerability affects version 1.0, with publicly available exploit code and no known patch. EPSS score is low (0.09%), indicating lower immediate exploitation probability, but the public PoC increases risk." I need to synthesize. Do NOT copy description. Start with impact: "SQL injection in /admin/manage_seat.php of Campcodes Online Movie Theater Seat Reservation System 1.0 lets remote attackers inject arbitrary SQL commands via the ID parameter, enabling data manipulation or extraction. Public exploit code exists, and while EPSS suggests low exploitation probability, the lack of authentication for the vulnerable endpoint heightens risk." I'll craft a summary. Mention that the file is an admin panel but authentication not mentioned? CVSS says PR:N (no privileges required), UI:N, so unauthenticated. So it's unauthenticated SQL injection on the admin page, likely accessible without authentication. So summary: "Unauthenticated SQL injection in the /admin/manage_seat.php endpoint of Campcodes Online Movie Theater Seat Reservation System 1.0 allows remote attackers to manipulate database queries via the ID parameter. Publicly available exploit code and no patch increase the urgency of mitigation. EPSS probability is low at 0.09%, but unauthenticated access and ease of exploitation warrant high attention."

technical_context: "The vulnerability is a SQL injection (CWE-89) in a PHP-based web application (Campcodes Online Movie Theater Seat Reservation System). The affected file /admin/manage_seat.php likely uses user-supplied input in SQL queries without proper sanitization, allowing injection of malicious SQL statements. The CPE identifier cpe:2.3:a:campcodes:online_movie_theater_seat_reservation_system:1.0:*:*:*:*:*:*:* confirms the exact affected product version. Given the PHP tag, the application likely uses MySQL or similar, and the admin panel might be accessible without authentication (PR:N per CVSS 4.0), leaving the database exposed to remote attacks. The CWE-74 is generic injection, but this is specifically SQL injection."

risk_assessment: "The risk is significant due to unauthenticated remote access (CVSS 4.0: AV:N/PR:N/UI:N) and SQL injection, which can lead to data breach or modification. However, the CVSS score is only 5.5 (Medium) in the 4.0 scale, with low impact metrics (VC:L/VI:L/VA:L) suggesting limited confidentiality, integrity, and availability impact. This seems contradictory: a SQL injection often allows full database control, but the vector only shows low impact, perhaps due to the assessor's conservative estimate. EPSS score 0.09% indicates only a 0.09% chance of exploitation in the next 30 days, which is low, but percentile 25% shows it's above just 25% of all CVEs—above average but still low. POC is publicly available, but KEV status is not mentioned, so no confirmed active exploitation. The SSVC decision framework would note: exploitation exists (PoC), automatable (yes, remote unauthenticated), technical impact could be high (depending on database privileges). But careful: CVSS indicates low impact, which could mean the SQL injection might be limited, e.g., only reading some data or the database user has restricted privileges. However, given typical PHP apps, SQL injection often leads to full compromise. So risk is moderate to high. The low CVSS score may be misleading. I'll note the discrepancy: "CVSS 4.0 vector shows low impact across confidentiality, integrity, availability, which may underestimate the real-world impact of SQL injection; typical exploitation could lead to full database disclosure. The EPSS score is low, but public PoC makes exploitation accessible to script kiddies. Combined with unauthenticated access, organizations using this product should consider it a high risk until a patch is available." I'll state the missing info: no KEV, no vendor patch, no advisory. So "No vendor advisory or patch identified; only third-party disclosure with PoC. The risk assessment is based on public disclosure, not vendor confirmation."

affected_products: "Campcodes Online Movie Theater Seat Reservation System version 1.0 (CPE: cpe:2.3:a:campcodes:online_movie_theater_seat_reservation_system:1.0:*:*:*:*:*:*:*). No other versions are reported affected. The product appears to be a free or open-source project from Campcodes; no official advisory link was provided in the references."

remediation: "No vendor patch has been released. As an immediate mitigation, restrict access to the /admin directory by IP whitelisting or implementing authentication if not already in place (note: CVSS indicates PR:N, so likely no authentication, but verify). Alternatively, disable the vulnerable manage_seat.php or apply input sanitization to the ID parameter to filter SQL metacharacters. Consider migrating away from unsupported software, as Campcodes products are often unmaintained. Given the exploit is public, apply web application firewall rules to block malicious SQL injection patterns targeting this endpoint."

exploit_scenario: "An attacker sends a crafted HTTP request to /admin/manage_seat.php?ID=[payload] to inject SQL commands. This could leak usernames, passwords, or other sensitive data from the database, or modify database contents to manipulate seat reservations. Since the endpoint likely lacks authentication, the attack can be performed by anyone with network access to the web server."

exploitation_conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Campcodes Online Movie Theater Seat Reservation System 1.0. The vulnerable endpoint /admin/manage_seat.php is accessible without authentication (PR:N per CVSS 4.0) and processes the ID parameter unsanitized. If the application is deployed with access controls (e.g., .htaccess) that restrict the admin directory, exploitation would require bypassing those controls, but the default configuration appears wide open."

attack_chain: "Send crafted HTTP GET request with malicious ID parameter → Trigger SQL injection in manage_seat.php → Execute arbitrary SQL queries on backend database → Exfiltrate or modify data"

confidence_notes: "CVSS vector, EPSS, and PoC are sourced from NVD/VulDB. No vendor advisory or patch confirmed; the product is from Campcodes, a source of many vulnerable applications often without official support. Active exploitation not reported by CISA KEV. Impact assessed as low by the CVSS 4.0 vector, but the actual database privileges may elevate the risk. All details based on third-party disclosure; vendor confirmation missing."

prevalence: "low" (since this is a niche PHP application from a vendor that produces many small, often unsupported systems, unlikely widely deployed).

prevalence_basis: "Niche application from Campcodes, likely minimal enterprise deployment."

assessed_cvss_vector: I need to create an independent CVSS 3.1 vector. Based on the description: network attack, no authentication required (though admin path might suggest some? But CVSS 4.0 says PR:N, so assuming no auth), low complexity, no user interaction, no scope change? The SQL injection might affect the database, which is a different component? Could be scope changed if the database is a separate system, but typically SQL injection is within the application's security scope. So I'll set S:U. Confidentiality: potentially high (data exfiltration), Integrity: high (modify DB), Availability: could be high if I can drop tables, but low if I can't. The CVSS 4.0 vector's low impact likely because they assume limited database user privileges. But typical SQL injection in PHP apps uses application's DB user, which often has full privileges. I'll be more realistic: given unauthenticated SQL injection, the impact can