Employee Management System CVE-2025-8172

Q: What is the CVSS score of CVE-2025-8172?

CVE-2025-8172 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-25 cna@vuldb.com

PHP SQLi Employee Management System

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:48 vuln.today

DescriptionCVE.org

A vulnerability, which was classified as critical, was found in itsourcecode Employee Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in itsourcecode Employee Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Username parameter in /admin/index.php, resulting in limited confidentiality and integrity impact. Despite a critical classification in the initial report, the CVSS 4.0 vector assigns a severity of 2.1 with low scope impact and requires authenticated access (PR:L), significantly reducing real-world risk. Public exploit code is available, but the extremely low EPSS score (0.06%, 19th percentile) suggests minimal practical exploitation despite disclosure.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements used in an Output Command) in a PHP-based employee management web application. The /admin/index.php endpoint accepts user-supplied input via the Username parameter without proper parameterized query controls or input validation, allowing SQL injection payloads to be embedded directly into SQL statements. The attack surface is limited to the admin interface, requiring prior authentication. The CVE affects itsourcecode Employee Management System version 1.0 specifically (CPE: cpe:2.3:a:clivedelacruz:employee_management_system:1.0).

RemediationAI

The primary remediation is to upgrade to a patched version if available from the vendor itsourcecode.com, or apply a security update that introduces parameterized queries and input validation for the Username parameter in /admin/index.php. If no patch is available from the vendor, implement compensating controls: (1) Restrict access to the /admin/index.php endpoint by IP whitelist or WAF rules to only trusted administrative networks - this eliminates remote attack surface entirely; (2) Deploy a Web Application Firewall (WAF) rule set to detect and block common SQL injection patterns in the Username parameter (e.g., single quotes, SQL keywords); (3) Implement database-level least privilege by ensuring the application database user account has minimal permissions (no UNION, DROP, or administrative commands). If upgrading to a later version is not feasible, consider disabling the admin interface entirely if functionality permits, or migrate to an actively maintained employee management solution. Check vendor advisory at itsourcecode.com for official patch availability and version history.