CVE-2025-7471 is a high severity SQL injection flaw (CVSS 7.3) in code-projects Modern Bag version 1.0, reached through the user-name argument of /admin/login-back.php. The record names no patched release, so the fix is to correct the code, restrict access to the app, or retire it.
What's affected
The record names code-projects Modern Bag, version 1.0. The weak spot is the user-name argument handled by the file /admin/login-back.php. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. In plain terms: reachable over the network, low attack complexity, no privileges and no user interaction needed, and a low impact on each of confidentiality, integrity and availability, for a base score of 7.3.
The NVD description calls the issue critical, which is the wording VulDB uses for this family of reports. The CVSS base score of 7.3 falls in the High band, so this post uses High. If your own scoring treats a public database injection as critical because of what the database holds, that is a fair local call.
No fixed version appears in the record or its references. Treat every copy of version 1.0 as affected until you have confirmed otherwise with the vendor. The record says the exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. Public detail still lowers the effort needed to try it, so do not wait on that distinction.
How to check if you're exposed
First find out whether you run the product at all. Search web roots and repositories for the file named in the record.
find /var/www -type f -name "login-back.php" -path "*admin*"
Then open the file and look at how user-name reaches the database. A query built by joining text together with request data is the pattern to look for.
grep -n "_GET\|_POST\|_REQUEST\|mysqli_query\|->query(" /path/to/login-back.php
Finally, check web server logs for requests to /admin/login-back.php with unusual characters in user-name, such as stray quotes or SQL keywords. A hit does not prove a breach, but it tells you whether anyone has probed the page.
If you cannot find the product, run a free scan of your repositories and manifests at gold.safeguard.sh/scan. It reports known CVEs for the dependencies it can see. A hand-written PHP project may not appear in a package inventory, so a file search on the server is the more reliable check here.
What to do now
- Find every copy of code-projects Modern Bag you run, including test and demo servers, and note which ones face the internet.
- Take internet-facing copies offline, or put them behind a VPN, a login proxy or an IP allow list until the code is fixed.
- Change the query behind /admin/login-back.php so
user-nameis passed as a bound parameter in a prepared statement, never joined into the SQL text. Validate its type and length too. - Review the other pages in the app for the same pattern. Apps of this kind repeat one query style, and several sibling CVEs exist for the same product family.
- Give the database account the app uses only the rights it needs. It should not own the schema or hold file or admin privileges.
- Watch the vendor site and the NVD record for a fix. If the product is a sample or abandoned project, plan to replace it, and check the advisory before relying on any claim of a patch.
- Rescan after changes and add the app to a recurring check so a regression is caught.
Why it matters
The record maps this to CWE-74 and CWE-89: request data reaches a SQL statement as text. The database then reads that data as part of the command, which is why a single unchecked argument can expose or alter stored records.
The page sits under the admin area, which can mean the data behind it is more sensitive, although the record lists no privilege requirement for the attack. The fix pattern is old and well understood. Prepared statements keep the SQL text fixed and send values separately, which removes the problem at the source. Escaping by hand misses cases, so use it only as a second layer.
Quick check
Is there a patched version of Modern Bag?
The record and its references do not name one. Check the vendor site and the advisory before assuming there is, and fix the code yourself if you must keep running it.
Is a web application firewall enough?
It can reduce noise and block common patterns, but it is a stopgap. The durable fix is parameterized queries in the code.
Sources
The other references in the record are public researcher write-ups and database entries. This post does not reproduce them and gives no attack steps.
Last reviewed: 18 October 2026.
