Vehicle Management
CVE-2025-8329
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network SQL injection yields full DB read/write (C:H/I:H); availability rated Low as service disruption requires deliberate destructive queries rather than incidental impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability, which was classified as critical, was found in code-projects Vehicle Management 1.0. This affects an unknown part of the file /filter3.php. The manipulation of the argument company leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
AnalysisAI
SQL injection in code-projects Vehicle Management 1.0 exposes unauthenticated remote attackers to arbitrary database query manipulation via the company parameter in /filter3.php. A public POC has been disclosed on GitHub, enabling database enumeration, credential or record exfiltration, and data modification with no authentication required. Despite the ease of exploitation, an EPSS score of 0.07% (20th percentile) and the absence of a CISA KEV listing reflect the product's negligible real-world deployment footprint - consistent with a tutorial/demo application rather than enterprise software.
Technical ContextAI
Vehicle Management 1.0 (CPE: cpe:2.3:a:code-projects:vehicle_management:1.0:*:*:*:*:*:*:*) is a PHP-based web application published by code-projects.org, a site distributing educational and demonstration PHP projects. The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), specifically classic SQL injection arising from unsanitized user-supplied input in the company parameter being concatenated directly into a backend SQL query inside /filter3.php without use of parameterized queries or prepared statements. The VulDB disclosure notes that 'other parameters might be affected as well,' indicating the sanitization failure is likely systemic across the file rather than confined to a single parameter, which is consistent with pattern-level absence of input handling in tutorial-grade PHP codebases.
RemediationAI
No vendor-released patch has been identified at time of analysis. The correct fix is to replace string-concatenated SQL query construction in /filter3.php with parameterized queries or PDO prepared statements in PHP - this addresses the CWE-74 root cause at the source and eliminates the injection surface for the company parameter and any other affected parameters. As a compensating control, a Web Application Firewall with SQL injection rulesets (e.g., OWASP ModSecurity Core Rule Set) can block common payload patterns at the network edge, though sophisticated encoding or bypass techniques can evade WAF signatures and should not be treated as a complete mitigation. Restricting network access to /filter3.php via IP allowlist or HTTP basic authentication at the web server level reduces the attack surface if the filter endpoint does not require broad user access; this introduces friction for legitimate users but is low-risk operationally. If this is a demonstration or development instance, taking the application offline is the most effective remediation. See the disclosure at https://vuldb.com/?ctiid.318279 for timeline details.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today