Which versions of PHP are affected by CVE-2025-6312?

A publicly disclosed SQL injection vulnerability in Campcodes Sales and Inventory System 1.0 allows remote attackers to compromise database integrity and potentially access sensitive business data…

Is there a public PoC exploit available for CVE-2025-6312?

Yes, a public proof-of-concept exploit is available for CVE-2025-6312. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6312?

Within 24 hours: Isolate affected Campcodes instances from production networks or restrict network access to trusted users only; audit database access logs for suspicious activity. Within 7 days: Contact Campcodes for patch status and timeline; implement WAF rules to block SQL injection payloads targeting /pages/cash_transaction.php; conduct database integrity audit. Within 30 days: Deploy patched version or migrate to alternative inventory system; perform penetration testing to validate remediation.

PHP CVE-2025-6312

Q: What is the CVSS score of CVE-2025-6312?

CVE-2025-6312 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18723 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-20 cna@vuldb.com

PHP SQLi Sales And Inventory System Campcodes

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-18723

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

PoC Detected

Jul 11, 2025 - 15:50 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 06:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pages/cash_transaction.php. The manipulation of the argument cid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6312 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System version 1.0, specifically in the /pages/cash_transaction.php file where the 'cid' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploitation details available, making it actively exploitable in the wild.

Technical ContextAI

This vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), specifically manifesting as SQL injection (a subset of injection attacks). The affected application is Campcodes Sales and Inventory System 1.0, a web-based inventory management platform written in PHP. The vulnerability exists in the cash_transaction.php page handler, where user-supplied input from the 'cid' parameter is directly concatenated into SQL queries without proper parameterized statements or input validation. The application likely uses PHP with a database backend (MySQL/MariaDB or similar), and the lack of prepared statements or ORM protection allows an attacker to break out of the intended SQL context and inject arbitrary SQL commands.