Is there a public PoC exploit available for CVE-2025-8373?

Yes, a public proof-of-concept exploit is available for CVE-2025-8373. Prioritise patching immediately. EPSS: 0.1%.

Vehicle Management CVE-2025-8373

Q: What is the CVSS score of CVE-2025-8373?

CVE-2025-8373 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-31 cna@vuldb.com

PHP SQLi Vehicle Management Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-accessible unauthenticated SQLi with low confidentiality and integrity impact on the vulnerable system; no availability impact described in the vulnerability report.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 11:39 vuln.today

CVE Published

Jul 31, 2025 - 08:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in code-projects Vehicle Management 1.0. It has been classified as critical. This affects an unknown part of the file /print.php. The manipulation of the argument sno leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Vehicle Management 1.0 exposes the /print.php endpoint to remote unauthenticated database manipulation via the unsanitized sno parameter. Any attacker with network access to the application can craft malicious HTTP requests to read or modify backend database contents without authentication, as confirmed by the CVSS 4.0 PR:N metric. A public proof-of-concept exploit is available on GitHub, though the EPSS score of 0.07% (20th percentile) indicates limited automated exploitation activity at this time; no CISA KEV listing is present.

Technical ContextAI

The vulnerability is rooted in CWE-74 (Injection), specifically classic SQL injection in a PHP web application. The affected endpoint /print.php constructs SQL queries using the sno (serial number) request parameter without applying parameterized queries or input sanitization, allowing attackers to append arbitrary SQL clauses. The affected product is confirmed via CPE cpe:2.3:a:code-projects:vehicle_management:1.0:*:*:*:*:*:*:*, a PHP-based vehicle management system distributed by code-projects.org. PHP applications lacking prepared statements are a well-established SQL injection attack surface, and the /print.php endpoint likely generates vehicle or record reports, making it a data-rich query target.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary remediation is to rewrite the SQL query in /print.php to use parameterized prepared statements (PDO or MySQLi with bound parameters), eliminating the injection surface entirely. As an immediate compensating control, restrict network access to /print.php via web server ACL rules or firewall policy if the endpoint does not require broad public exposure - this trades functionality for a significant risk reduction. Deploying a web application firewall (WAF) rule to block SQL metacharacters in the sno parameter provides partial mitigation but is bypassable and should not substitute for code-level fixes. Database account privilege reduction (granting the application DB user SELECT-only rights where possible) limits the blast radius of exploitation. Monitor database query logs for anomalous patterns referencing /print.php. See https://vuldb.com/?id.318345 and https://github.com/wllovemy/cve/issues/7 for technical details.