Which versions of PHP are affected by EUVD-2025-17107?

A critical SQL injection vulnerability in Real Estate Property Management System 1.0 allows unauthenticated attackers to remotely compromise the database, potentially exposing sensitive property,…

Is there a public PoC exploit available for EUVD-2025-17107?

Yes, a public proof-of-concept exploit is available for EUVD-2025-17107. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2025-17107?

Within 24 hours: Immediately take the /Admin/EditCity.php endpoint offline or restrict access to internal networks only; enable WAF rules to block SQL injection patterns targeting this file; audit database access logs for suspicious activity. Within 7 days: Conduct forensic analysis to determine if compromise has occurred; contact the vendor for a timeline on patch availability; evaluate alternative property management systems if patching timeline is uncertain. Within 30 days: Implement network segmentation to isolate the application; deploy robust input validation and parameterized queries as compensating controls; schedule migration to a patched version or replacement system.

PHP EUVD-2025-17107

Q: What is the CVSS score of EUVD-2025-17107?

EUVD-2025-17107 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2025-5756 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-06 cna@vuldb.com

PHP SQLi Real Estate Property Management System Fabian

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17107

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

PoC Detected

Oct 23, 2025 - 20:06 vuln.today

Public exploit code

CVE Published

Jun 06, 2025 - 10:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Real Estate Property Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /Admin/EditCity.php. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical SQL injection vulnerability in code-projects Real Estate Property Management System version 1.0, specifically in the /Admin/EditCity.php endpoint. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The exploit has been publicly disclosed with proof-of-concept code available, and the vulnerability is likely being actively exploited in the wild.

Technical ContextAI

The vulnerability stems from improper input validation and parameterization in the EditCity.php administrative interface, classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'). The root cause is the failure to properly sanitize or use prepared statements for user-supplied input before incorporating it into SQL queries. This is a classic SQL injection flaw where user-controlled parameters (likely city name, ID, or other form fields) are directly concatenated into dynamically constructed SQL statements without proper escaping or parameterized query mechanisms. The affected product is code-projects Real Estate Property Management System 1.0, a PHP-based web application handling property management operations.

RemediationAI

Immediate remediation actions: (1) Apply input validation and output encoding to all user-supplied parameters in EditCity.php, specifically implementing allowlist-based validation for city names and identifiers; (2) Refactor all SQL queries to use parameterized prepared statements (mysqli_prepare() or PDO prepared statements in PHP) instead of string concatenation; (3) Implement principle of least privilege for database user accounts—ensure the application database user has minimal necessary permissions; (4) Deploy Web Application Firewall (WAF) rules to block common SQL injection patterns (SQL keywords, comment syntax, union-based attacks) targeting the /Admin/ directory; (5) Apply strong authentication controls to administrative functions; (6) Contact code-projects for patch availability—if unavailable, consider forking/patching the codebase internally or migrating to a patched or alternative solution. Code review of other administrative endpoints (EditProperty.php, EditAgent.php, etc.) is strongly recommended given the pattern of vulnerability.