Vehicle Management
CVE-2025-8407
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable SQLi; no complexity barriers; SQL injection typically yields full DB read (C:H) and write (I:H) with limited availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability, which was classified as critical, has been found in code-projects Vehicle Management 1.0. This issue affects some unknown processing of the file /filter2.php. The manipulation of the argument from leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
SQL injection in code-projects Vehicle Management 1.0 allows unauthenticated remote attackers to manipulate backend database queries via the unsanitized from parameter in /filter2.php. A publicly available proof-of-concept exploit is documented on GitHub, making exploitation trivial against any network-exposed instance. No active exploitation is confirmed in CISA KEV, and the EPSS score of 0.07% (20th percentile) reflects the product's niche deployment footprint rather than low severity - the underlying flaw class is serious but real-world exposure is narrow.
Technical ContextAI
The affected product is code-projects Vehicle Management version 1.0, a PHP-based web application identified by CPE cpe:2.3:a:code-projects:vehicle_management:1.0:*:*:*:*:*:*:*. The vulnerability resides in /filter2.php, where the HTTP parameter from is incorporated into backend SQL queries through string concatenation rather than parameterized queries or prepared statements. The root cause is classified as CWE-74 (Injection), the parent category encompassing CWE-89 (SQL Injection) - a failure to neutralize user-controlled input before it is interpreted as SQL control syntax by the database engine. PHP applications using legacy mysql_query or similar non-parameterized patterns are archetypal carriers of this flaw class.
RemediationAI
No vendor-released patch has been identified at time of analysis; code-projects has not published a fix or security advisory for this issue. The definitive remediation is to rewrite the SQL query construction in /filter2.php to use parameterized prepared statements via PHP's PDO or MySQLi extensions, ensuring the from parameter is bound as a data value rather than concatenated into the query string. As an interim compensating control, deploying a Web Application Firewall rule to block SQL metacharacters (quotes, comment sequences, UNION keywords) in the from parameter can reduce exploitation risk, though WAF rules can be bypassed by sufficiently obfuscated payloads - this should not be treated as a permanent fix. The most effective short-term mitigation is to restrict network access to the application to trusted internal IP ranges and remove any internet-facing exposure, since this is an educational project unlikely to require public accessibility. Reference: https://vuldb.com/?id.318395.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today