Which versions of PHP are affected by EUVD-2025-18711?

A SQL injection vulnerability in Hostel Management System 1.0 allows unauthenticated remote attackers to compromise the database without requiring a patch.

Is there a public PoC exploit available for EUVD-2025-18711?

Yes, a public proof-of-concept exploit is available for EUVD-2025-18711. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2025-18711?

Within 24 hours: Identify all systems running Hostel Management System 1.0 and assess internet exposure of the /empty_rooms.php endpoint. Within 7 days: Implement WAF rules to block SQL injection patterns in the search_box parameter, restrict network access to the application, or disable the /empty_rooms.php functionality if non-critical. Within 30 days: Plan migration to alternative software, develop a vendor communication strategy to request patch availability, and conduct database audit for unauthorized access.

PHP EUVD-2025-18711

Q: What is the CVSS score of EUVD-2025-18711?

EUVD-2025-18711 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2025-6296 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-20 cna@vuldb.com

PHP SQLi Hostel Management System Fabian

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-18711

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

PoC Detected

Oct 23, 2025 - 20:06 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 02:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Hostel Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /empty_rooms.php. The manipulation of the argument search_box leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6296 is a critical SQL injection vulnerability in code-projects Hostel Management System version 1.0, specifically in the /empty_rooms.php file's search_box parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially achieving unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploits available, making active exploitation highly probable in real-world deployments.

Technical ContextAI

The vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, 'Injection'), manifesting as SQL injection. The /empty_rooms.php file fails to properly sanitize or parameterize user-supplied input from the search_box parameter before incorporating it into SQL queries. This is a classic web application input validation failure where unsanitized user input is concatenated directly into SQL statements. The affected product is code-projects Hostel Management System, a PHP-based web application (CPE identifier would be cpe:2.3:a:code-projects:hostel_management_system:1.0:*:*:*:*:*:*:*), suggesting the vulnerability affects PHP-based database operations, likely interfacing with MySQL or similar relational databases commonly used in PHP applications.

RemediationAI

Contact code-projects vendor for security update or patch version >1.0. Monitor vendor website/repository for patches.; timeline: Apply immediately upon availability (Critical severity) Workaround - Input Validation: Implement strict whitelist validation for search_box parameter. Only allow alphanumeric characters and spaces. Reject special characters including quotes, dashes, parentheses, and SQL keywords. Workaround - Parameterized Queries: Refactor /empty_rooms.php to use prepared statements/parameterized queries (PDO or MySQLi prepared statements in PHP) instead of string concatenation for all database interactions. Workaround - WAF Rules: Deploy Web Application Firewall (ModSecurity, AWS WAF, Cloudflare) with SQL injection detection rules targeting /empty_rooms.php. Block requests containing SQL keywords and union statements in search_box parameter. Workaround - Database Permissions: Configure database user account for the application with minimal privileges (SELECT-only on necessary tables, no DROP/ALTER). This limits blast radius if SQL injection succeeds. Detection/Monitoring: Implement SQL query logging and anomaly detection. Monitor for unusual query patterns, error-based SQL injection attempts, or unexpected table/column access from the application account.