CVE-2025-7605

HIGH

AVL Rooms 1.0 - SQL Injection via Profile First Name Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-7605. PoCs published by sunhuiHi666.

AI-analyzed exploit summary This repository provides a functional SQL injection payload for CVE-2025-7605, targeting the 'first_name' parameter in AVL Rooms Project V1.0's /profile.php file. The payload demonstrates a time-based blind SQL injection technique, confirming the vulnerability's exploitability.

Description

A vulnerability was found in code-projects AVL Rooms 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /profile.php. The manipulation of the argument first_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Exploits (1)

nomisec WORKING POC
by sunhuiHi666 · poc
https://github.com/sunhuiHi666/CVE-2025-7605

This repository provides a functional SQL injection payload for CVE-2025-7605, targeting the 'first_name' parameter in AVL Rooms Project V1.0's /profile.php file. The payload demonstrates a time-based blind SQL injection technique, confirming the vulnerability's exploitability.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: AVL Rooms Project V1.0
No auth needed
Prerequisites: Access to the vulnerable /profile.php endpoint
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.316304
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.316304
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.615340
Exploit, Issue Tracking exploit issue-tracking
https://github.com/sunhuiHi666/cve/issues/2
Product product
https://code-projects.org/

Scores

CVSS v3 7.3
EPSS 0.0040
EPSS Percentile 31.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (1)
anisha/avl_rooms 1.0
Published Jul 14, 2025
Tracked Since Feb 18, 2026