Which versions of PHP are affected by CVE-2025-6405?

A publicly disclosed SQL injection vulnerability in the Campcodes Online Teacher Record Management System allows remote attackers to compromise the administrative teacher records database without…

Is there a public PoC exploit available for CVE-2025-6405?

Yes, a public proof-of-concept exploit is available for CVE-2025-6405. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6405?

Within 24 hours: Identify all instances of Campcodes version 1.0 in production and isolate affected systems from internet-facing access if possible; implement Web Application Firewall (WAF) rules to block requests containing SQL injection patterns to the /admin/edit-teacher-detail.php endpoint; restrict administrative access via network segmentation. Within 7 days: Conduct a forensic audit of database logs to identify unauthorized access attempts or data exfiltration since system deployment; reset all administrative credentials. Within 30 days: Contact Campcodes for patch availability or upgrade timeline; evaluate alternative solutions if patches remain unavailable; implement mandatory code review and penetration testing before deploying any vendor updates.

PHP CVE-2025-6405

Q: What is the CVSS score of CVE-2025-6405?

CVE-2025-6405 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18813 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-21 cna@vuldb.com

PHP SQLi Online Teacher Record Management System Campcodes

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 21:35 euvd

EUVD-2025-18813

Analysis Generated

Mar 15, 2026 - 21:35 vuln.today

PoC Detected

Jun 24, 2025 - 19:16 vuln.today

Public exploit code

CVE Published

Jun 21, 2025 - 14:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability classified as critical was found in Campcodes Online Teacher Record Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/edit-teacher-detail.php. The manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6405 is a critical SQL injection vulnerability in Campcodes Online Teacher Record Management System version 1.0, affecting the /admin/edit-teacher-detail.php endpoint through an unsanitized 'editid' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of teacher records and sensitive educational data. Public disclosure and proof-of-concept availability indicate active exploitation risk, though CVSS 7.3 reflects moderate actual impact (read/write/availability) rather than complete system compromise.

Technical ContextAI

The vulnerability stems from CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), specifically SQL injection in the admin panel. The /admin/edit-teacher-detail.php file fails to properly sanitize or parameterize the 'editid' GET/POST parameter before incorporating it into SQL queries. Campcodes Online Teacher Record Management System 1.0 (CPE: cpe:2.3:a:campcodes:online_teacher_record_management_system:1.0:*:*:*:*:*:*:*) is a web-based educational administration platform typically built on PHP/MySQL or similar stack. The lack of prepared statements or input validation allows attackers to inject malicious SQL syntax (UNION-based, time-based blind, or error-based injection techniques) to bypass authentication and access backend databases.

RemediationAI

Immediate Patch: Upgrade to Campcodes Online Teacher Record Management System version 1.1 or later (if available). Check vendor website/repository for security updates.; priority: CRITICAL Code-Level Mitigation (if patch unavailable): Implement parameterized queries (prepared statements) in /admin/edit-teacher-detail.php. Replace direct string concatenation in SQL queries with bound parameters: use mysqli_prepare() or PDO prepared statements. Sanitize editid input with intval() or whitelist validation to ensure it matches expected teacher ID format.; priority: HIGH Input Validation: Enforce strict input validation: whitelist numeric values for editid (should be integer teacher ID). Reject or escape any non-numeric characters before database query.; priority: HIGH WAF/Network Mitigation: Deploy Web Application Firewall (WAF) rules to detect and block common SQL injection payloads in the editid parameter (pattern matching for UNION, SELECT, OR 1=1, etc.). This is temporary mitigation only.; priority: MEDIUM Access Control: Restrict admin panel access (/admin/*) via IP whitelist, VPN, or authentication gateway until patch is applied. Limit admin user accounts to essential personnel only.; priority: MEDIUM Monitoring: Enable SQL error logging and monitor for unusual query patterns in application/database logs. Alert on failed admin login attempts and anomalous /admin/edit-teacher-detail.php requests.; priority: MEDIUM