itsourcecode Insurance Management System CVE-2025-7904

SPECIFIC CONDITION - Attacker must possess valid application authentication credentials (low privilege level acceptable per CVSS PR:L rating). The vulnerability requires direct network access to /insertNominee.php endpoint. No user interaction required. The nominee_id parameter must accept the attacker's unsanitized SQL payload without encoding or parameterization. LIMITING FACTORS: (1) Authentication barrier - unauthenticated remote attackers cannot exploit this; only users with valid accounts or those who compromise an account can proceed. (2) The impact is confined to confidentiality and integrity of nominee data; no authentication bypass, full system compromise, or availability impact is documented. (3) Exploitation requires knowledge of the specific application endpoint path and parameter name, though this is disclosed in public POC.

This CVE presents a significant discrepancy between severity classification and realistic exploitation risk. The CVSS 4.0 vector shows AV:N (network-accessible) and AC:L (low attack complexity), but critically includes PR:L (requires low-level authentication) - meaning an attacker must first obtain valid application credentials. The EPSS score of 0.09 (25th percentile) strongly contradicts the critical designation, indicating observed exploitation in the wild is minimal despite public POC availability. The limited technical impact ratings (VC:L, VI:L, VA:L with SC:N, SI:N, SA:N) further indicate this is not a full-database compromise scenario but rather isolated data manipulation. The discrepancy between critical CVSS classification and low EPSS suggests either: (1) the application has minimal deployment footprint, (2) the authentication requirement effectively restricts attacker pools, or (3) real-world exploitability is lower than theoretical metrics suggest. This is a confirmed case where high-CVSS-but-low-real-risk assessment is appropriate - prioritize based on whether your organization runs this specific insurance application.

An attacker with valid application credentials (e.g., a low-privileged insurance agent account or compromised user account) submits a crafted HTTP request to /insertNominee.php with a SQL injection payload in the nominee_id parameter, such as nominee_id=1' OR '1'='1, bypassing intended query logic to extract or modify nominee records. The publicly available POC demonstrates the exact payload and endpoint, making exploitation straightforward for anyone with application access and knowledge of the POC.