EUVD-2025-18437Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged credentials
-
DeliveryAccess /insertClient.php
-
ExploitSubmit crafted client_id parameter
-
ExecutionTrigger SQL injection
-
ImpactExtract or modify database content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | Exploitation requires an authenticated low-privileged account on the Life Insurance Management System to access the /insertClient.php endpoint and inject SQL via the client_id parameter. No additional configuration or user interaction is needed beyond possessing valid credentials. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N) presents a low-severity scenario with network attack vector, low complexity, low privileges, and limited impact. EPSS score of 0.06% (18th percentile) suggests very low exploitation likelihood. No KEV entry indicates no known active exploitation, though public exploit code exists. Using SSVC, the decision is likely 'monitor' given the low technical impact and absence of active exploitation. This is not a high-priority threat; risk is low. |
| Exploit ScenarioDerived | An attacker with a low-privileged account sends a crafted HTTP request to /insertClient.php containing a malicious SQL payload in the client_id parameter. The database executes the injected query, allowing the attacker to extract sensitive client data or tamper with records. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
SQL injection in Projectworlds Life Insurance Management System 1.0 enables remote attackers with low privileges to manipulate the client_id parameter in /insertClient.php, leading to unauthorized database access and potential data modification. Public exploit code is available, but EPSS indicates a low probability of widespread exploitation, and no active exploitation has been reported.
Earlier versions of this analysis (1)
RemediationAI
No vendor-released patch has been identified. As an immediate mitigation, apply strict input validation and parameterized queries to the /insertClient.php endpoint to neutralize SQL injection risks. Restrict network access to this endpoint to trusted users or internal networks. If feasible, migrate away from this unsupported product. Advisory information is available from VulDB at https://vuldb.com/?id.312603.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in a PHP application using direct SQL queries, where user-supplied input via the client_id parameter is not properly sanitized before being used in database operations. This is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, i.e., injection). The affected product is identified by CPE cpe:2.3:a:projectworlds:life_insurance_management_system:1.0.
Know when Life Insurance Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Low-privileged remote attacker with easy exploitation; limited confidentiality, integrity, and availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in Projectworlds Life Insurance Management System 1.0. It has been classified as critical. This affects an unknown part of the file /insertClient.php. The manipulation of the argument client_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
Executive ViewAI
Organizations using A vulnerability should be aware of moderate risk from CVE-2025-6134, a injection vulnerability rated CVSS 6.3. Exploitation could allow attackers to execute code or inject malicious input. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
A vulnerability classified as critical was found in SourceCodester Life Insurance Management System 1.0. Rated critical
Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php.
A vulnerability was found in projectworlds Life Insurance Management System 1.0 and classified as critical.php. Rated me
A vulnerability, which was classified as critical, was found in projectworlds Life Insurance Management System 1.0. Rate
A vulnerability, which was classified as critical, has been found in projectworlds Life Insurance Management System 1.0.
A vulnerability classified as critical was found in projectworlds Life Insurance Management System 1.0. Rated medium sev
A vulnerability has been found in projectworlds Life Insurance Management System 1.0 and classified as critical. Rated m
A vulnerability classified as critical has been found in projectworlds Life Insurance Management System 1.0. Rated mediu
A cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts or HTML
A vulnerability was found in SourceCodester Life Insurance Management System 1.0. Rated medium severity (CVSS 6.1), this
A vulnerability was found in Project Worlds Life Insurance Management System 1.0. Rated medium severity (CVSS 5.3), this
A vulnerability was found in Project Worlds Life Insurance Management System 1.0. Rated medium severity (CVSS 5.3), this
Exploit-DB