Online Appointment Booking System EUVD-2025-21272

While the CVSS 3.1 score of 7.3 (High severity) reflects the vulnerability's impact potential, multiple factors elevate real-world exploitation risk: (1) Attack Vector is Network (AV:N) with Low Complexity (AC:L), enabling trivial remote exploitation; (2) No authentication required (PR:N), eliminating access barriers; (3) Public disclosure and available proof-of-concept code dramatically increase the likelihood of active exploitation; (4) The CVSS vector (C:L/I:L/A:L) indicates confidentiality, integrity, and availability impacts are all realizable; (5) The vulnerability affects a publicly-facing web application component used for appointment booking, creating broad exposure. The combination of ease of exploitation (network-based, no auth) and public POC availability suggests this vulnerability is likely already being actively targeted by threat actors and automated scanning tools. SSVC analysis would rate this as IMMEDIATE priority due to: automatable exploitation (web-based SQL injection), public POC availability, and technical impact on sensitive customer data in an appointment system.

An attacker discovers the public proof-of-concept code for CVE-2025-7541 and crafts a malicious HTTP request to an organization's appointment booking system. The attacker navigates to the vulnerable /get_town.php endpoint and injects SQL code into the 'countryid' parameter, for example: /get_town.php?countryid=1 UNION SELECT username,password FROM admin_users--. Since the parameter is not sanitized, the injected SQL executes on the backend database server. The attacker successfully extracts sensitive data such as administrator credentials, customer appointment records (including phone numbers and email addresses), or payment information. Alternatively, the attacker could modify database records to disrupt service operations or execute more severe attacks. Given the network-based attack vector and absence of authentication requirements, this exploitation requires minimal technical skill and can be executed through simple HTTP requests or automated scanning tools that test for SQL injection vulnerabilities.