Which versions of PHP are affected by CVE-2025-6354?

A critical SQL injection vulnerability in the Online Shoe Store customer signup function allows unauthenticated remote attackers to compromise the database.

Is there a public PoC exploit available for CVE-2025-6354?

Yes, a public proof-of-concept exploit is available for CVE-2025-6354. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6354?

Within 24 hours: Disable the /function/customer_signup.php endpoint or restrict access via firewall/WAF rules to prevent exploitation. Within 7 days: Implement WAF rules to filter malicious SQL syntax in email parameters; conduct database audit for signs of compromise. Within 30 days: Contact vendor for patch timeline; evaluate alternative signup solutions or rebuild the affected functionality with secure coding practices; complete forensic analysis and notify affected customers if breach is confirmed.

PHP CVE-2025-6354

Q: What is the CVSS score of CVE-2025-6354?

CVE-2025-6354 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18767 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-20 cna@vuldb.com

PHP SQLi Online Shoe Store Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-18767

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

PoC Detected

Jun 26, 2025 - 13:30 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 17:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability, which was classified as critical, has been found in code-projects Online Shoe Store 1.0. Affected by this issue is some unknown functionality of the file /function/customer_signup.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6354 is a critical SQL injection vulnerability in code-projects Online Shoe Store 1.0 affecting the customer signup functionality (/function/customer_signup.php). An unauthenticated remote attacker can manipulate the email parameter to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept availability and demonstrates active exploitation potential.

Technical ContextAI

This vulnerability is rooted in improper input validation and parameterization in PHP-based web application code. The affected file (customer_signup.php) fails to properly sanitize or use prepared statements when processing the email parameter before incorporating it into SQL queries. This is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which encompasses SQL injection attacks where user-supplied input reaches database query construction without adequate escaping or parameterization. The Online Shoe Store application uses direct string concatenation or inadequate filtering when building SQL statements, allowing attackers to break out of intended query logic and execute arbitrary SQL commands against the backend database.

RemediationAI

Immediate remediation steps: (1) Implement parameterized queries using prepared statements in the customer_signup.php file—use mysqli prepared statements or PDO with bound parameters instead of string concatenation; (2) Apply input validation to reject malformed email addresses before database processing; (3) Use email validation regex patterns to ensure input conforms to RFC 5322 standards; (4) Implement stored procedures with parameterized inputs if possible; (5) Apply the principle of least privilege to database user accounts accessing the signup function, limiting permissions to INSERT operations only where feasible. Vendor patch: Contact code-projects for a patched version or consider migrating to an actively maintained e-commerce platform. If patched versions are unavailable, apply Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the email parameter (e.g., blocking single quotes, SQL keywords like UNION, OR 1=1).