Is there a public PoC exploit available for CVE-2025-8409?

Yes, a public proof-of-concept exploit is available for CVE-2025-8409. Prioritise patching immediately. EPSS: 0.1%.

Vehicle Management CVE-2025-8409

Q: What is the CVSS score of CVE-2025-8409?

CVE-2025-8409 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-31 cna@vuldb.com

PHP SQLi Vehicle Management Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible endpoint with no auth or interaction required; SQL injection yields partial database read, write, and availability impact with no scope change to other systems.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 11:34 vuln.today

CVE Published

Jul 31, 2025 - 16:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability has been found in code-projects Vehicle Management 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /filter.php. The manipulation of the argument from leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Vehicle Management 1.0 exposes the /filter.php endpoint to remote, unauthenticated database manipulation via the unsanitized from parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and a public proof-of-concept exploit is disclosed on GitHub. Despite the trivial exploitation conditions, EPSS at 0.07% (20th percentile) and absence from the CISA KEV catalog indicate no observed widespread exploitation at time of analysis.

Technical ContextAI

The affected component is a PHP web application distributed by code-projects (CPE: cpe:2.3:a:code-projects:vehicle_management:1.0:*:*:*:*:*:*:*). The /filter.php script directly incorporates the user-supplied from GET or POST parameter into a backend SQL query without parameterization or adequate escaping, enabling classic SQL injection. The root cause maps to CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), a broad injection class encompassing SQL, command, and related injection vectors. In practice, this manifests as the absence of prepared statements or PDO-bound parameters, which is a foundational secure-coding failure in PHP database interaction. The specific parameter name (from) suggests it likely corresponds to a date-range or filter-field query, making it a data-retrieval path with potentially broad database read access.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary remediation is a code-level fix: replace dynamic SQL string concatenation in /filter.php with PHP PDO or MySQLi prepared statements with bound parameters, specifically for the from parameter. As an immediate compensating control, restrict access to /filter.php at the web server (e.g., Apache/Nginx deny rule) or network perimeter to block external requests - note this may break filter functionality for legitimate users. Deploying a WAF rule targeting SQL injection patterns (single quotes, UNION, comment sequences) in the from parameter can reduce opportunistic risk while a code fix is prepared, though WAFs can be bypassed and should not be treated as a permanent solution. If Vehicle Management 1.0 is not in active production use, the safest control is to take the application offline. Reference: VulDB advisory at https://vuldb.com/?id.318397 and GitHub POC at https://github.com/wllovemy/cve/issues/1.