Job Diary EUVD-2025-21335

This vulnerability presents genuine, exploitable risk across multiple dimensions: (1) CVSS 7.3 with AV:N/AC:L/PR:N/UI:N indicates network-exploitable attack with no authentication or user interaction required, placing it in the moderate-high severity range; (2) public disclosure and available proof-of-concept code significantly elevates exploitation probability; (3) the SQL injection classification suggests high technical impact enabling data exfiltration, authentication bypass, or data manipulation; (4) no user interaction requirement makes this automatable for mass exploitation; (5) the application appears to be a diary/journaling system potentially containing sensitive personal or organizational data. While CVSS is 7.3 (not critical 9+), the combination of public POC availability, trivial exploitation prerequisites, and direct database access means this should be treated as critical priority. SSVC would likely classify this as Scheduled or Immediate remediation due to public exploitation and high technical impact.

An unauthenticated attacker sends an HTTP GET/POST request to the vulnerable Job Diary instance at /view-all.php?ID=1' OR '1'='1 (or similar SQL injection payload). The application directly concatenates this unsanitized input into a backend SQL query such as SELECT * FROM entries WHERE ID = [user_input]. The malicious payload breaks out of the intended query context, allowing the attacker to execute arbitrary SQL—for example, extracting all user records (SELECT * FROM users), modifying diary entries (UPDATE entries SET content='hacked' WHERE 1=1), or deleting data. Because no authentication is required and the attack is trivial to automate, attackers can exploit this at scale across all exposed instances of Job Diary 1.0. A public POC likely demonstrates exfiltration of sensitive diary contents or privilege escalation via SQL commands.