EUVD-2025-21217
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4DescriptionNVD
A vulnerability was found in code-projects Job Diary 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /search.php. The manipulation of the argument Search leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
CVE-2025-7474 is a critical SQL injection vulnerability in code-projects Job Diary 1.0 affecting the /search.php file's Search parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands with potential data exfiltration, modification, and application disruption. The exploit has been publicly disclosed with proof-of-concept code available, and the vulnerability meets the criteria for inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog due to active real-world exploitation.
Technical ContextAI
The vulnerability stems from improper input validation and parameterization in the Search parameter of /search.php, classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'). The root cause involves unsanitized user input being directly concatenated into SQL queries without prepared statements or parameterized query mechanisms. Job Diary 1.0 is a PHP-based application (CPE: cpe:2.3:a:code-projects:job_diary:1.0:*:*:*:*:*:*:*) that typically runs on standard LAMP stacks. The /search.php endpoint accepts GET/POST parameters without adequate escaping, enabling classic SQL injection techniques such as UNION-based, time-based blind, or error-based injection methods.
Share
External POC / Exploit Code
Leaving vuln.today