Vehicle Management
CVE-2025-8330
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated SQL injection with no interaction; limited C/I/A (L/L/L) as database access does not imply full system or OS compromise.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in code-projects Vehicle Management 1.0 and classified as critical. This vulnerability affects unknown code of the file /edit1.php. The manipulation of the argument sno leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
SQL injection in code-projects Vehicle Management 1.0 allows remote unauthenticated attackers to manipulate the sno parameter in /edit1.php, enabling unauthorized reading, modification, or deletion of backend database contents. A public proof-of-concept is disclosed on GitHub (zgqsdx/cve/issues/1), materially lowering the exploitation barrier despite an EPSS score of 0.07% (20th percentile) that reflects the application's negligible real-world deployment footprint. This vulnerability is not listed in the CISA KEV catalog; no public exploit identified at time of analysis as actively exploited in the wild, though publicly available exploit code exists.
Technical ContextAI
The affected application is a PHP-based vehicle management system available from code-projects.org, identified by CPE cpe:2.3:a:code-projects:vehicle_management:1.0:*:*:*:*:*:*:*. The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), specifically classic SQL injection where the sno parameter accepted by /edit1.php is incorporated into a backend SQL query without sanitization or parameterization. This allows an attacker to append or alter SQL syntax, redirecting query logic. The PHP stack without prepared statements or input validation is the underlying failure mode; the vulnerability is consistent with unsanitized direct variable interpolation into SQL query strings.
RemediationAI
No vendor-released patch has been identified at time of analysis for code-projects Vehicle Management 1.0; no fix version or vendor advisory URL is available in the referenced sources. As a primary compensating control, restrict public access to /edit1.php at the web server level (e.g., via Apache .htaccess or nginx location block deny rules), which limits exploitation to already-authenticated or internally-networked users - the trade-off is loss of that functionality for legitimate remote users. Deploying a Web Application Firewall rule to block SQL metacharacters (single quotes, SQL keywords) in the sno parameter reduces automated exploitation risk, though crafted payloads can bypass naive WAF rules. If the application is non-essential or a development artifact, taking it offline entirely eliminates the attack surface with no functional trade-off. The public exploit is documented at https://github.com/zgqsdx/cve/issues/1 and catalogued at https://vuldb.com/?id.318280.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today