PT-2025-29470 · Code Projects · Electricity Billing System

Zzb1 · Published 2025-07-14 · Updated 2025-07-14 · CVE-2025-7610

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: code-projects Electricity Billing System version 1.0

Description: A critical issue exists in code-projects Electricity Billing System version 1.0. The vulnerability is due to a SQL injection flaw within the /user/change password.php file. Manipulation of the new password argument can lead to unauthorized database access. The exploit for this issue has been publicly disclosed and may be used to launch remote attacks.

Recommendations: As a temporary workaround, consider restricting access to the /user/change password.php file until a fix is available. Avoid using the new password parameter in the affected file /user/change password.php until the issue is resolved.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-7610

Affected Products

Electricity Billing System

References · 10

• 🔥 https://github.com/zzb1388/cve/issues/17 · Exploit
• https://osv.dev/vulnerability/CVE-2025-7610 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7610 · Security Note
• https://vuldb.com/?submit.615361 · Note
• https://vuldb.com/?id.316310 · Note
• https://twitter.com/CVEnew/status/1944770727262986714 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1944782820271939897 · Twitter Post
• https://t.me/cvetracker/27785 · Telegram Post
• https://vuldb.com/?ctiid.316310 · Note
• https://code-projects.org · Note