EUVD-2025-21359
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability was found in code-projects Mobile Shop 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-7612 is a critical SQL injection vulnerability in code-projects Mobile Shop 1.0 affecting the /login.php file's email parameter, allowing remote unauthenticated attackers to execute arbitrary SQL queries and potentially extract or modify sensitive data. The vulnerability has been publicly disclosed with exploit code available, making it actively exploitable in the wild. With a CVSS score of 7.3 and demonstrated public PoC availability, this represents an immediate threat to deployments of this product.
Technical Context
The vulnerability exists in the authentication mechanism of Mobile Shop 1.0, specifically within /login.php where user-supplied input via the 'email' parameter is insufficiently sanitized before being incorporated into SQL queries. This classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component) allows attackers to break out of intended SQL syntax and inject malicious commands. The affected component is the login authentication layer, typically responsible for credential verification. Without proper parameterized queries or input validation, attackers can manipulate the email parameter to alter query logic, bypass authentication controls, or extract database contents. CPE designation would be: cpe:2.3:a:code-projects:mobile_shop:1.0:*:*:*:*:*:*:*
Affected Products
code-projects Mobile Shop version 1.0 - all installations. Affected component: /login.php file, specifically the email parameter in the authentication handler. No version information or vendor patches are referenced, suggesting this may be a legacy or abandoned product. Vendors using this codebase or derivatives should audit for similar patterns. CPE: cpe:2.3:a:code-projects:mobile_shop:1.0:*:*:*:*:*:*:*
Remediation
Immediate actions: (1) Patch/Update: Check code-projects project repository or vendor advisories for patched versions beyond 1.0 (likelihood low if abandoned); if unavailable, perform in-house remediation; (2) Input Validation: Implement strict email format validation using regex or built-in validators, rejecting inputs containing SQL metacharacters; (3) Parameterized Queries: Replace all string concatenation in SQL queries with prepared statements/parameterized queries for the email parameter and all user inputs; (4) Escape Special Characters: If parameterized queries are unavailable, apply database-specific escaping functions (e.g., mysqli_real_escape_string for MySQL); (5) WAF/IPS: Deploy Web Application Firewall rules to detect and block SQL injection patterns in login requests (signatures targeting UNION, SELECT, OR 1=1, etc.); (6) Database Permissions: Apply principle of least privilege—limit login.php database user account to SELECT-only on authentication tables, preventing INSERT/UPDATE/DELETE exploitation; (7) Monitoring: Implement logging and alerting on unusual SQL query patterns or authentication failures; (8) Consider Migration: Evaluate migration to a maintained alternative if code-projects Mobile Shop is no longer actively supported. No official vendor patches are currently available in references.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today