EUVD-2025-18440Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to application with low-privileged account
-
ExploitSubmit crafted HTTP request to /insertagent.php with SQL payload in agent_id
-
ImpactManipulate database query to extract sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | The attacker must possess low-level authentication credentials to access the /insertagent.php endpoint. The agent_id parameter is directly incorporated into SQL queries without sanitization. No other configuration changes or special conditions are required. |
| Impact | CVSS 4.0 base vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L indicates low impact on confidentiality, integrity, and availability, requiring low privileges but no user interaction. EPSS 0.06% (18th percentile) suggests a very low probability of widespread exploitation. Public exploit code exists (E:P in CVSS 4.0) but the flaw is absent from CISA KEV, meaning no active exploitation is known. The overall real-world risk is moderate-low: easy to exploit but with minimal damage, and unlikely to affect many targets given the product’s niche footprint. |
| Exploit ScenarioDerived | An attacker with low-privileged access to the application sends a crafted HTTP POST request to /insertagent.php containing malicious SQL in the agent_id parameter. This successfully exfiltrates data from the backend database (e.g., user records, policy details) or modifies existing entries. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
SQL injection in Projectworlds Life Insurance Management System 1.0 via the agent_id parameter in /insertagent.php allows authenticated remote attackers to manipulate database queries. Public exploit code is available, but no active exploitation has been confirmed. The vulnerability has low impact (C:L/I:L/A:L) and a very low EPSS score (0.06%), suggesting limited real-world risk.
Earlier versions of this analysis (1)
RemediationAI
No vendor-released patch is available at this time. As a temporary mitigation, restrict network access to the /insertagent.php endpoint to trusted IPs or disable the agent insertion feature entirely if it is not business-critical. Employing a web application firewall (WAF) with SQL injection protections and applying strict input validation to the agent_id parameter can reduce exposure. The definitive fix is to refactor the PHP code to use prepared statements with parameter binding. Note that disabling /insertagent.php may break agent creation workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a SQL injection (CWE-89) in a PHP-based web application. The affected endpoint, /insertagent.php, uses the agent_id parameter in a database query without proper sanitization or parameterization. Attackers can inject malicious SQL statements, potentially reading, modifying, or deleting data. The product is packaged as a single version 1.0, identified by CPE cpe:2.3:a:projectworlds:life_insurance_management_system:1.0.
Know when Life Insurance Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Low privileges required, no user interaction, low impact across all three security properties.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in Projectworlds Life Insurance Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /insertagent.php. The manipulation of the argument agent_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Organizations using A vulnerability should be aware of moderate risk from CVE-2025-6133, a injection vulnerability rated CVSS 6.3. Exploitation could allow attackers to execute code or inject malicious input. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
A vulnerability classified as critical was found in SourceCodester Life Insurance Management System 1.0. Rated critical
Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php.
A vulnerability was found in projectworlds Life Insurance Management System 1.0 and classified as critical.php. Rated me
A vulnerability, which was classified as critical, was found in projectworlds Life Insurance Management System 1.0. Rate
A vulnerability, which was classified as critical, has been found in projectworlds Life Insurance Management System 1.0.
A vulnerability classified as critical was found in projectworlds Life Insurance Management System 1.0. Rated medium sev
A vulnerability has been found in projectworlds Life Insurance Management System 1.0 and classified as critical. Rated m
A vulnerability classified as critical has been found in projectworlds Life Insurance Management System 1.0. Rated mediu
A cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts or HTML
A vulnerability was found in SourceCodester Life Insurance Management System 1.0. Rated medium severity (CVSS 6.1), this
A vulnerability was found in Project Worlds Life Insurance Management System 1.0. Rated medium severity (CVSS 5.3), this
A vulnerability was found in Project Worlds Life Insurance Management System 1.0. Rated medium severity (CVSS 5.3), this
Exploit-DB