EUVD-2025-21014
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4DescriptionNVD
A vulnerability was found in code-projects LifeStyle Store 1.0. It has been classified as critical. Affected is an unknown function of the file /cart_remove.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
CVE-2025-7410 is a critical SQL injection vulnerability in code-projects LifeStyle Store version 1.0, affecting the /cart_remove.php file's ID parameter. An unauthenticated remote attacker can exploit this vulnerability over the network to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
Technical ContextAI
This vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which describes the failure to sanitize user input before SQL operations. The /cart_remove.php file accepts an ID parameter that is directly concatenated or used in SQL queries without proper parameterized query use or input validation. The LifeStyle Store application (code-projects version 1.0) is a PHP-based e-commerce platform where the cart removal functionality should validate and escape all user-supplied ID values before database operations. The lack of prepared statements or parameterized queries allows attackers to inject malicious SQL syntax through the ID parameter, bypassing intended application logic.
RemediationAI
Immediate actions: (1) Apply input validation to the ID parameter in /cart_remove.php—whitelist numeric-only values if ID is intended to be numeric, or use strict type checking. (2) Implement parameterized prepared statements (mysqli prepared statements or PDO prepared statements in PHP) for all database queries instead of string concatenation. (3) Use an ORM framework (e.g., Doctrine, Eloquent) that automatically handles query parameterization. (4) Implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in the ID parameter. (5) Contact code-projects for an official patch or security update; if unavailable, consider forking or replacing the application with maintained alternatives. (6) Temporarily, restrict access to /cart_remove.php via IP allowlisting or authentication enforcement until patched. Long-term: migrate to a maintained e-commerce platform with active security updates.
Share
External POC / Exploit Code
Leaving vuln.today