EUVD-2025-18730CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Tags
Description
A vulnerability classified as critical has been found in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /admin/confirm.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-6317 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, affecting the /admin/confirm.php file's ID parameter. An unauthenticated remote attacker can execute arbitrary SQL commands with low complexity, potentially leading to unauthorized data access, modification, or service disruption. Public exploit disclosure and active attack feasibility significantly elevate real-world risk despite the moderate CVSS score of 7.3.
Technical Context
The vulnerability stems from CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), specifically manifesting as SQL injection in a PHP-based e-commerce application. The /admin/confirm.php file fails to properly sanitize or parameterize user-supplied input in the ID parameter before incorporating it into SQL queries. This is a classic improper input validation issue where user-controlled data (ID parameter) is directly concatenated into SQL statements without using prepared statements, parameterized queries, or proper escaping. The affected product is code-projects Online Shoe Store 1.0, a small-scale e-commerce platform vulnerable in its administrative interface. CPE notation would be: cpe:2.3:a:code-projects:online_shoe_store:1.0:*:*:*:*:*:*:*
Affected Products
Product: code-projects Online Shoe Store; Affected Version(s): 1.0 (all installations); Vulnerable Component: /admin/confirm.php; Vulnerable Parameter: ID; No patch or updated version information is publicly documented as of this analysis. The vendor (code-projects) has not issued a security advisory or patch based on available intelligence. Users remain unprotected unless they implement workarounds or migrate to alternative platforms.
Remediation
Immediate actions: (1) Implement input validation: whitelist ID parameter to accept only numeric values using regex or type casting (e.g., (int)$_GET['id']); (2) Use prepared statements with parameterized queries in all SQL operations—replace mysqli_query() or PDO execute() calls with prepared statement versions (mysqli_prepare() + bind_param() or PDO::prepare() + execute()); (3) Apply principle of least privilege to database user account executing queries (read-only for confirmation operations); (4) Disable direct web access to /admin/ directory if possible, or restrict via .htaccess (Deny from all) and authenticate via alternative mechanism; (5) Implement Web Application Firewall (WAF) rules to detect and block common SQL injection payloads (UNION-based, time-based blind, error-based); (6) Conduct full code audit of all user input handling in admin interface. Long-term: upgrade from Online Shoe Store 1.0 to a maintained e-commerce platform (Magento, WooCommerce, Prestashop) with security updates. No official vendor patch is available; contact code-projects development team for guidance.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today