Avl Rooms EUVD-2025-21348

Despite the critical rating designation, the CVSS 3.1 score of 7.3 (High, not Critical) and vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects moderate real-world impact with limited scope. The vulnerability scores for Confidentiality, Integrity, and Availability as 'Low' rather than 'High', suggesting SQL injection impact may be constrained by database permissions or application logic. However, the exploitation signals are concerning: (1) public disclosure and POC availability dramatically increase exploitation likelihood, (2) the unauthenticated, low-complexity attack vector (AC:L/PR:N) means any network-connected attacker can attempt exploitation, (3) AVL Rooms 1.0 is a legacy or niche application suggesting slow patch adoption. The EPSS score would likely be elevated (estimated 70-85%) given public POC and network accessibility. Under SSVC framework: Exploitation=Active (public POC), Automatable=Yes (SQL injection tools abundant), Technical Impact=Medium (data breach possible but scope limited). Real-world priority is HIGH despite moderate CVSS due to exploitability signals and lack of authentication barriers.

An attacker crafts an HTTP request to http://target.com/profile.php with a malicious SQL payload in the first_name parameter, for example: first_name='; DROP TABLE users; -- or first_name=' UNION SELECT password FROM admin_users --. Since the application lacks input validation and prepares SQL statements via string concatenation, the payload is executed directly by the database. With no authentication required (PR:N), the attacker can extract user data, modify application records, escalate privileges, or in worst case (depending on database permissions) drop tables. If public POC exists (which is indicated), automated tools and scripts are available for mass exploitation of unpatched instances. The low attack complexity (AC:L) means the exploit succeeds reliably without special network conditions or application-specific bypasses.