Which versions of PHP are affected by CVE-2025-6403?

A critical SQL injection vulnerability in the School Fees Payment System (CVE-2025-6403) allows remote attackers to manipulate student payment data and potentially access sensitive financial and…

Is there a public PoC exploit available for CVE-2025-6403?

Yes, a public proof-of-concept exploit is available for CVE-2025-6403. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2025-6403?

Within 24 hours: Assess if School Fees Payment System 1.0 is deployed in production and identify all systems accessing /student.php; implement WAF rules to block SQL injection patterns in the ID parameter; enable detailed logging on the affected endpoint. Within 7 days: Conduct database audit for unauthorized access or data exfiltration; isolate the payment system from external internet access if operationally feasible; prepare communication plan for affected students. Within 30 days: Monitor vendor (code-projects) for security patch release and apply immediately upon availability; perform full security code review; consider migrating to alternative payment system if patch is not released within 30 days.

PHP CVE-2025-6403

Q: What is the CVSS score of CVE-2025-6403?

CVE-2025-6403 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2025-18809 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-21 cna@vuldb.com

PHP SQLi School Fees Payment System Fabian

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 21:35 euvd

EUVD-2025-18809

Analysis Generated

Mar 15, 2026 - 21:35 vuln.today

PoC Detected

Jul 02, 2025 - 18:56 vuln.today

Public exploit code

CVE Published

Jun 21, 2025 - 10:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects School Fees Payment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6403 is a critical SQL injection vulnerability in code-projects School Fees Payment System version 1.0, specifically in the /student.php file's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of student and payment records. The vulnerability has been publicly disclosed with working exploits available, and while the CVSS score of 7.3 indicates medium-to-high severity, the SQL injection vector combined with public PoC availability presents significant real-world risk for deployed instances.

Technical ContextAI

This vulnerability stems from CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as 'Injection'), manifesting as SQL injection in a PHP-based web application. The School Fees Payment System processes student records via the /student.php endpoint, which fails to properly sanitize or parameterize the 'ID' parameter before incorporating it into SQL queries. The root cause is insufficient input validation and lack of prepared statements or parameterized queries. The application likely uses direct string concatenation to build SQL queries (e.g., SELECT * FROM students WHERE id = + $_GET['ID']), allowing attackers to inject SQL metacharacters (quotes, semicolons, SQL keywords) to manipulate query logic. This is a classic injection flaw in PHP applications that predate modern ORM frameworks and secure coding practices.

RemediationAI

Immediate actions: (1) Apply input validation: Implement strict whitelist validation for the ID parameter (numeric-only if ID is an integer); (2) Use prepared statements: Replace all dynamic SQL with parameterized queries using mysqli_prepare() or PDO prepared statements with bound parameters; (3) Code example (PHP/PDO): $stmt = $pdo->prepare('SELECT * FROM students WHERE id = ?'); $stmt->execute([$_GET['ID']]); instead of SELECT * FROM students WHERE id = . $_GET['ID']; (4) WAF/IDS rules: Deploy Web Application Firewall rules to block SQL injection patterns (quotes, SQL keywords, comment syntax) in the ID parameter; (5) Principle of least privilege: Ensure database user credentials for the application have minimal necessary permissions (SELECT only on student records, no DROP/ALTER); (6) Check for vendor patches: Contact code-projects or review their repository for security updates—if no patch exists, consider migration to maintained alternatives (e.g., open-source school management systems with active security patching). No official CVE patch link is provided; remediation requires manual code review and patching by the deploying organization.