Which versions of PHP are affected by CVE-2025-6304?

A SQL injection vulnerability in the Online Shoe Store application's shopping cart function exposes customer data and enables unauthorized database access.

Is there a public PoC exploit available for CVE-2025-6304?

Yes, a public proof-of-concept exploit is available for CVE-2025-6304. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6304?

Within 24 hours: Take the affected application offline or restrict cart functionality; notify your hosting/infrastructure team and initiate incident response protocols. Within 7 days: Deploy WAF rules to block malicious qty[] parameter patterns; implement input validation and prepared statements as temporary fixes if development resources allow. Within 30 days: Obtain patched version from vendor or commission security patch development; conduct full code review of similar input handling; perform penetration testing post-remediation.

PHP CVE-2025-6304

Q: What is the CVSS score of CVE-2025-6304?

CVE-2025-6304 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18718 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-20 cna@vuldb.com

PHP SQLi Online Shoe Store Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-18718

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

PoC Detected

Jun 26, 2025 - 21:19 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 04:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Online Shoe Store 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /cart.php. The manipulation of the argument qty[] leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6304 is a critical SQL injection vulnerability in code-projects Online Shoe Store 1.0 affecting the /cart.php file's qty[] parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially extract, modify, or delete sensitive data. The vulnerability has been publicly disclosed with proof-of-concept exploits available, presenting immediate exploitation risk to unpatched instances of this e-commerce application.

Technical ContextAI

The vulnerability exists in the cart.php file of the Online Shoe Store application, where user-supplied input from the qty[] (quantity array) parameter is improperly sanitized before being incorporated into SQL queries. This represents a classic CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection') vulnerability, specifically SQL injection. The lack of parameterized queries or input validation on array-based parameters allows attackers to inject malicious SQL syntax through the quantity field, potentially bypassing authentication and authorization controls. The affected product is code-projects Online Shoe Store version 1.0, a PHP-based e-commerce application that appears to use a traditional relational database backend without proper prepared statement implementation.

RemediationAI

Immediate actions: (1) Apply input validation to qty[] parameters—use whitelist approach accepting only numeric values, rejecting special characters; (2) Implement parameterized queries/prepared statements for all database interactions in cart.php, replacing string concatenation with bound parameters; (3) If patches are unavailable from vendor (code-projects appears to lack active support), implement Web Application Firewall (WAF) rules blocking SQL injection patterns in cart requests; (4) Disable or isolate the Online Shoe Store application if not actively maintained and migrate to a supported e-commerce platform (WooCommerce, Magento, Shopify, etc.); (5) Conduct immediate database audit for unauthorized access or data exfiltration via this vector; (6) Apply principle of least privilege to database user account used by cart.php (remove administrative rights). Long-term: Migrate away from unsupported code-projects application to a actively maintained e-commerce solution.