Currency Exchange System
Monthly
Unsanitized ID parameter in /editotheraccount.php of code-projects Currency Exchange System 1.0 leads to SQL injection, allowing remote unauthenticated attackers to read, modify, or disrupt database contents with low confidentiality, integrity, and availability impact. Public exploit code is available; no active exploitation reported in CISA KEV. EPSS indicates a 0.04% probability of exploitation.
SQL injection in the Currency Exchange System 1.0 application allows unauthenticated remote attackers to manipulate SQL queries via the ID parameter in /edttrns.php. This can lead to unauthorized access to database contents or modification of exchange records. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
We need to analyze the CVE and synthesize all data into a comprehensive JSON response. The instructions are very detailed. First, extract key facts: - CVE ID: CVE-2025-14216 - Description: Vulnerability in code-projects Currency Exchange System 1.0. Unknown processing of file /viewserial.php, argument ID causes SQL injection. Remote attack possible. Exploit publicly disclosed. - CVSS Score: 5.5 (low? medium? CVSS 4.0 base 5.5, but no 3.1 provided; only 4.0 vector) - CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (vendor: VulDB also has CVSS 3.0 5.3? Not provided, only 4.0). For our own assessed CVSS 3.1 and 4.0 vectors, we'll derive from description. Vulnerability is SQL injection, remote, unauthenticated? The CVSS vector says PR:N, UI:N, so unauthenticated, no user interaction. Attack complexity low. Impact: Low on Confidentiality, Integrity, Availability. So it's an SQLi with limited impact. But description says "ID causes sql injection". We'll produce our own vector consistent with that. For 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L? That would be 7.3. But wait, CVSS 4.0 base score 5.5 given, but they set VC:L/VI:L/VA:L (low impact for all). In CVSS 3.1, Low for all is 5.3? Let's check: CVSS 3.1 base score with AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L = 7.3 (High) actually. Wait, no: CVSS 3.1, network vector, low complexity, no privileges, no interaction, unchanged scope, low confidentiality, low integrity, low availability -> 7.3 (High). But they gave CVSS 4.0 5.5 which is lower than 7.0. That's because CVSS 4.0 reweights impacts. So we need to decide our own assessment. Given the product is a simple currency exchange system, impact might be low: maybe reading some data, altering some data, causing some downtime. We'll adopt that impact, so CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Rationale: SQL injection, remote unauthenticated, low complexity, low impact across all. CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That matches the given vector but we set E:P (exploit maturity public) in our vector? In base vector we don't include temporal metrics; base only. So our assessed CVSS 4.0 base vector would be CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's exactly the same as provided base (they had E:P in temporal, but base is fine). We'll output that. Rationale: "Unvalidated user input in SQL query, low impact due to limited data exposure." CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), which includes SQL injection. Product name: "Currency Exchange System" (from code-projects). So product_name: "Currency Exchange System". But the description says "code-projects Currency Exchange System 1.0". So primary: "Currency Exchange System". Could also be "code-projects Currency Exchange System" but the instructions say 1-3 words, so "Currency Exchange System" is enough. We'll use "Currency Exchange System". Summary: Original synthesis, not copying description. Mention it's a SQL injection in /viewserial.php parameter ID, remote unauthenticated, exploit disclosed. Not in KEV, EPSS low. So: "SQL injection in code-projects Currency Exchange System 1.0 allows remote unauthenticated attackers to extract or modify database contents via the ID parameter in /viewserial.php." Something like that. Technical context: Mention the web application, PHP, MySQL? CPE indicates 'fabian' vendor, product currency_exchange_system:1.0. The vulnerability is SQL injection (CWE-74) due to improper input sanitization in the PHP script. Use CPE data. Risk assessment: CVSS 4.0 score 5.5 (medium). EPSS 0.04% (lowest percentile). No KEV. POC public. So threat is low despite medium CVSS. The product appears to be a small code-projects project, likely not widely deployed. So risk is low. Mention that CVSS vector indicates network attack, low complexity, no privileges, low impact, making it easy to exploit but limited damage. EPSS low indicates low likelihood of widespread exploitation. Not in KEV, so not actively targeted in the wild. So it's not a high priority for most organizations. SSVC: Exploitation (POC public) but not automatable? SQL injection can be automated. Technical impact partially controlled (low). But given real-world usage, low risk. So overall: "While CVSS score suggests a medium-severity vulnerability with easy remote exploitation, EPSS probability is very low (0.04%) indicating negligible likelihood of widespread exploitation. The software is a simple academic-style project with limited deployment, further reducing real-world risk. Not in CISA KEV, so no targeted exploitation observed." Affected products: "Currency Exchange System 1.0 by code-projects (vendor: fabian). CPE: cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:*" Reference advisory: EUVD, VulDB, but no official vendor advisory from code-projects. We'll list references provided. "Affected product: code-projects Currency Exchange System version 1.0 (CPE: cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:*). See VulDB advisory (https://vuldb.com/?id.334658) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-14216)." Remediation: No patch available from the original source (code-projects). The references don't indicate a fix. We'll state: "No vendor patch has been released as the software appears to be unmaintained; consider disabling the application or restricting network access. As a workaround, sanitize the ID parameter in /viewserial.php by using parameterized queries or input validation. Alternatively, block access to /viewserial.php via web server rules. Trade-off: blocking may disrupt legitimate functionality if required." Then mention advisory URLs. Exploit scenario: Attacker sends a crafted request to /viewserial.php with a malicious ID parameter containing SQL injection payload, extracting data or modifying the database. POC exists. Attack vector is network, low complexity. Exploitation conditions: "No special conditions — remote unauthenticated exploitation against default installation of Currency Exchange System 1.0. The vulnerable parameter ID is exposed in /viewserial.php with no input validation. The attack does not require authentication or user interaction." Limiting factors: none, just the product's low deployment. Attack chain: "Send HTTP GET request to /viewserial.php with crafted ID parameter → Inject SQL code via unsanitized input → Execute arbitrary SQL queries on backend database → Extract or modify sensitive data." Confidence notes: "Vulnerability confirmed by VulDB and included in NVD with public exploit. No vendor advisory or patch version exists. Affected version is confirmed as 1.0 by CPE; no other versions known." Prevalence: "rare" - because it's a simple academic project, not widely deployed. Prevalence_basis: "small code-projects demo, unlikely deployed in enterprise." Now, build JSON. All fields must be strings. I'll construct each paragraph as plain text without bullet points. product_name: "Currency Exchange System" summary: "SQL injection in code-projects Currency Exchange System 1.0 allows remote unauthenticated attackers to manipulate the database via the ID parameter in /viewserial.php. Exploit code is publicly available but active exploitation has not been observed, and EPSS probability is very low. This low-impact flaw can lead to data exposure or modification." technical_context: "The application is a PHP-based web system using a MySQL database, where the script /viewserial.php fails to properly sanitize the ID parameter before constructing SQL queries, leading to CWE-74 (Injection). The CPE cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:* identifies the product as a lightweight web application from code-projects, likely intended for educational or demonstration purposes." risk_assessment: "The CVSS 4.0 base score of 5.5 (Medium) reflects a network-exploitable, unauthenticated SQL injection with low impact on confidentiality, integrity, and availability. However, EPSS score of 0.04% (11th percentile) indicates a very low probability of widespread exploitation. The product is not listed in CISA KEV, confirming no observed active targeting. Given the software’s limited real-world deployment, the actual risk is low for most organizations. There is no scope change or privilege escalation indicated, but the vulnerability is trivially exploitable via a single HTTP request." affected_products: "The only affected product is code-projects Currency Exchange System version 1.0, represented by CPE cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:*. No later versions or patches are documented. Advisory information is available at VulDB (https://vuldb.com/?id.334658) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-14216)." remediation: "No official patch exists, as the code-projects software appears unmaintained. In the absence of a vendor fix, restrict network access to the application or disable it entirely. If the application must stay active, implement input validation on the ID parameter in /viewserial.php to block SQL metacharacters, or better, rewrite the database access using parameterized queries. An additional compensating control is to block access to /viewserial.php via web server rules. However, these workarounds may disrupt legitimate functionality if the endpoint is required." exploit_scenario: "An attacker remotely accesses /viewserial.php and supplies a crafted ID parameter containing an SQL injection payload. The unsanitized input is embedded directly into a database query, allowing the attacker to execute arbitrary SQL commands—extracting user credentials, modifying exchange rates, or deleting records. A working proof-of-concept exploit is publicly available." exploitation_conditions: "No special conditions — remote unauthenticated exploitation against default installations of Currency Exchange System 1.0. The vulnerable endpoint /viewserial.php is publicly accessible, and the ID parameter is processed without authentication or input sanitization, requiring no user interaction." attack_chain: "Craft HTTP GET request with malicious ID parameter → Inject SQL code via unsanitized input → Execute arbitrary SQL queries on backend database → Exfiltrate or manipulate sensitive data." confidence_notes: "Confirmed by VulDB and NVD; public exploit available via GitHub and VulDB. No vendor patch or official advisory from the original developer (code-projects) exists. The affected version is exactly 1.0 as per CPE. EPSS score is low, and no active exploitation has been reported." prevalence: "rare" prevalence_basis: "small demo project from code-projects, minimal enterprise footprint." assessed_cvss_vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" assessed_cvss_rationale: "SQL injection via web parameter, no auth required; impact limited to database read/write." assessed_cvss40_vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" Now I'll double-check each field complies with rules. Confidence notes: we stated "public exploit available" but not "confirmed actively exploited", as no KEV. Good. Exploit scenario
SQL injection in Currency Exchange System 1.0 via the ID parameter in /edit.php allows remote attackers to manipulate database queries without authentication. Public exploit code exists, but EPSS probability is very low (0.04%) and no active exploitation is confirmed, indicating limited real-world targeting.
Unsanitized ID parameter in /editotheraccount.php of code-projects Currency Exchange System 1.0 leads to SQL injection, allowing remote unauthenticated attackers to read, modify, or disrupt database contents with low confidentiality, integrity, and availability impact. Public exploit code is available; no active exploitation reported in CISA KEV. EPSS indicates a 0.04% probability of exploitation.
SQL injection in the Currency Exchange System 1.0 application allows unauthenticated remote attackers to manipulate SQL queries via the ID parameter in /edttrns.php. This can lead to unauthorized access to database contents or modification of exchange records. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
We need to analyze the CVE and synthesize all data into a comprehensive JSON response. The instructions are very detailed. First, extract key facts: - CVE ID: CVE-2025-14216 - Description: Vulnerability in code-projects Currency Exchange System 1.0. Unknown processing of file /viewserial.php, argument ID causes SQL injection. Remote attack possible. Exploit publicly disclosed. - CVSS Score: 5.5 (low? medium? CVSS 4.0 base 5.5, but no 3.1 provided; only 4.0 vector) - CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (vendor: VulDB also has CVSS 3.0 5.3? Not provided, only 4.0). For our own assessed CVSS 3.1 and 4.0 vectors, we'll derive from description. Vulnerability is SQL injection, remote, unauthenticated? The CVSS vector says PR:N, UI:N, so unauthenticated, no user interaction. Attack complexity low. Impact: Low on Confidentiality, Integrity, Availability. So it's an SQLi with limited impact. But description says "ID causes sql injection". We'll produce our own vector consistent with that. For 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L? That would be 7.3. But wait, CVSS 4.0 base score 5.5 given, but they set VC:L/VI:L/VA:L (low impact for all). In CVSS 3.1, Low for all is 5.3? Let's check: CVSS 3.1 base score with AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L = 7.3 (High) actually. Wait, no: CVSS 3.1, network vector, low complexity, no privileges, no interaction, unchanged scope, low confidentiality, low integrity, low availability -> 7.3 (High). But they gave CVSS 4.0 5.5 which is lower than 7.0. That's because CVSS 4.0 reweights impacts. So we need to decide our own assessment. Given the product is a simple currency exchange system, impact might be low: maybe reading some data, altering some data, causing some downtime. We'll adopt that impact, so CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Rationale: SQL injection, remote unauthenticated, low complexity, low impact across all. CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That matches the given vector but we set E:P (exploit maturity public) in our vector? In base vector we don't include temporal metrics; base only. So our assessed CVSS 4.0 base vector would be CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's exactly the same as provided base (they had E:P in temporal, but base is fine). We'll output that. Rationale: "Unvalidated user input in SQL query, low impact due to limited data exposure." CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), which includes SQL injection. Product name: "Currency Exchange System" (from code-projects). So product_name: "Currency Exchange System". But the description says "code-projects Currency Exchange System 1.0". So primary: "Currency Exchange System". Could also be "code-projects Currency Exchange System" but the instructions say 1-3 words, so "Currency Exchange System" is enough. We'll use "Currency Exchange System". Summary: Original synthesis, not copying description. Mention it's a SQL injection in /viewserial.php parameter ID, remote unauthenticated, exploit disclosed. Not in KEV, EPSS low. So: "SQL injection in code-projects Currency Exchange System 1.0 allows remote unauthenticated attackers to extract or modify database contents via the ID parameter in /viewserial.php." Something like that. Technical context: Mention the web application, PHP, MySQL? CPE indicates 'fabian' vendor, product currency_exchange_system:1.0. The vulnerability is SQL injection (CWE-74) due to improper input sanitization in the PHP script. Use CPE data. Risk assessment: CVSS 4.0 score 5.5 (medium). EPSS 0.04% (lowest percentile). No KEV. POC public. So threat is low despite medium CVSS. The product appears to be a small code-projects project, likely not widely deployed. So risk is low. Mention that CVSS vector indicates network attack, low complexity, no privileges, low impact, making it easy to exploit but limited damage. EPSS low indicates low likelihood of widespread exploitation. Not in KEV, so not actively targeted in the wild. So it's not a high priority for most organizations. SSVC: Exploitation (POC public) but not automatable? SQL injection can be automated. Technical impact partially controlled (low). But given real-world usage, low risk. So overall: "While CVSS score suggests a medium-severity vulnerability with easy remote exploitation, EPSS probability is very low (0.04%) indicating negligible likelihood of widespread exploitation. The software is a simple academic-style project with limited deployment, further reducing real-world risk. Not in CISA KEV, so no targeted exploitation observed." Affected products: "Currency Exchange System 1.0 by code-projects (vendor: fabian). CPE: cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:*" Reference advisory: EUVD, VulDB, but no official vendor advisory from code-projects. We'll list references provided. "Affected product: code-projects Currency Exchange System version 1.0 (CPE: cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:*). See VulDB advisory (https://vuldb.com/?id.334658) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-14216)." Remediation: No patch available from the original source (code-projects). The references don't indicate a fix. We'll state: "No vendor patch has been released as the software appears to be unmaintained; consider disabling the application or restricting network access. As a workaround, sanitize the ID parameter in /viewserial.php by using parameterized queries or input validation. Alternatively, block access to /viewserial.php via web server rules. Trade-off: blocking may disrupt legitimate functionality if required." Then mention advisory URLs. Exploit scenario: Attacker sends a crafted request to /viewserial.php with a malicious ID parameter containing SQL injection payload, extracting data or modifying the database. POC exists. Attack vector is network, low complexity. Exploitation conditions: "No special conditions — remote unauthenticated exploitation against default installation of Currency Exchange System 1.0. The vulnerable parameter ID is exposed in /viewserial.php with no input validation. The attack does not require authentication or user interaction." Limiting factors: none, just the product's low deployment. Attack chain: "Send HTTP GET request to /viewserial.php with crafted ID parameter → Inject SQL code via unsanitized input → Execute arbitrary SQL queries on backend database → Extract or modify sensitive data." Confidence notes: "Vulnerability confirmed by VulDB and included in NVD with public exploit. No vendor advisory or patch version exists. Affected version is confirmed as 1.0 by CPE; no other versions known." Prevalence: "rare" - because it's a simple academic project, not widely deployed. Prevalence_basis: "small code-projects demo, unlikely deployed in enterprise." Now, build JSON. All fields must be strings. I'll construct each paragraph as plain text without bullet points. product_name: "Currency Exchange System" summary: "SQL injection in code-projects Currency Exchange System 1.0 allows remote unauthenticated attackers to manipulate the database via the ID parameter in /viewserial.php. Exploit code is publicly available but active exploitation has not been observed, and EPSS probability is very low. This low-impact flaw can lead to data exposure or modification." technical_context: "The application is a PHP-based web system using a MySQL database, where the script /viewserial.php fails to properly sanitize the ID parameter before constructing SQL queries, leading to CWE-74 (Injection). The CPE cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:* identifies the product as a lightweight web application from code-projects, likely intended for educational or demonstration purposes." risk_assessment: "The CVSS 4.0 base score of 5.5 (Medium) reflects a network-exploitable, unauthenticated SQL injection with low impact on confidentiality, integrity, and availability. However, EPSS score of 0.04% (11th percentile) indicates a very low probability of widespread exploitation. The product is not listed in CISA KEV, confirming no observed active targeting. Given the software’s limited real-world deployment, the actual risk is low for most organizations. There is no scope change or privilege escalation indicated, but the vulnerability is trivially exploitable via a single HTTP request." affected_products: "The only affected product is code-projects Currency Exchange System version 1.0, represented by CPE cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:*. No later versions or patches are documented. Advisory information is available at VulDB (https://vuldb.com/?id.334658) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-14216)." remediation: "No official patch exists, as the code-projects software appears unmaintained. In the absence of a vendor fix, restrict network access to the application or disable it entirely. If the application must stay active, implement input validation on the ID parameter in /viewserial.php to block SQL metacharacters, or better, rewrite the database access using parameterized queries. An additional compensating control is to block access to /viewserial.php via web server rules. However, these workarounds may disrupt legitimate functionality if the endpoint is required." exploit_scenario: "An attacker remotely accesses /viewserial.php and supplies a crafted ID parameter containing an SQL injection payload. The unsanitized input is embedded directly into a database query, allowing the attacker to execute arbitrary SQL commands—extracting user credentials, modifying exchange rates, or deleting records. A working proof-of-concept exploit is publicly available." exploitation_conditions: "No special conditions — remote unauthenticated exploitation against default installations of Currency Exchange System 1.0. The vulnerable endpoint /viewserial.php is publicly accessible, and the ID parameter is processed without authentication or input sanitization, requiring no user interaction." attack_chain: "Craft HTTP GET request with malicious ID parameter → Inject SQL code via unsanitized input → Execute arbitrary SQL queries on backend database → Exfiltrate or manipulate sensitive data." confidence_notes: "Confirmed by VulDB and NVD; public exploit available via GitHub and VulDB. No vendor patch or official advisory from the original developer (code-projects) exists. The affected version is exactly 1.0 as per CPE. EPSS score is low, and no active exploitation has been reported." prevalence: "rare" prevalence_basis: "small demo project from code-projects, minimal enterprise footprint." assessed_cvss_vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" assessed_cvss_rationale: "SQL injection via web parameter, no auth required; impact limited to database read/write." assessed_cvss40_vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" Now I'll double-check each field complies with rules. Confidence notes: we stated "public exploit available" but not "confirmed actively exploited", as no KEV. Good. Exploit scenario
SQL injection in Currency Exchange System 1.0 via the ID parameter in /edit.php allows remote attackers to manipulate database queries without authentication. Public exploit code exists, but EPSS probability is very low (0.04%) and no active exploitation is confirmed, indicating limited real-world targeting.