EUVD-2025-21220
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability classified as critical has been found in code-projects Simple Car Rental System 1.0. This affects an unknown part of the file /pay.php. The manipulation of the argument mpesa leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-7475 is a critical SQL injection vulnerability in code-projects Simple Car Rental System version 1.0, located in the /pay.php file where the 'mpesa' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database records. The vulnerability has been publicly disclosed with proof-of-concept availability, indicating active exploitation risk in real-world deployments.
Technical Context
This vulnerability represents a classic CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection') manifestation as SQL injection. The Simple Car Rental System 1.0 is a PHP-based web application (CPE: cpe:2.3:a:code-projects:simple_car_rental_system:1.0:*:*:*:*:*:*:*) that processes payment transactions via the /pay.php endpoint. The application fails to properly sanitize or parameterize the 'mpesa' input parameter before incorporating it into SQL queries. This allows attackers to break out of the intended SQL context and inject arbitrary SQL commands. The vulnerability is particularly severe because payment processing systems typically have direct access to sensitive financial and customer data, and the lack of input validation at this critical juncture creates a direct path to database compromise.
Affected Products
code-projects Simple Car Rental System (['1.0'])
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today