Which versions of PHP are affected by CVE-2025-6446?

A SQL injection vulnerability in Code-Projects Client Details System 1.0 allows unauthenticated remote attackers to compromise the admin interface, potentially exposing sensitive client data and…

Is there a public PoC exploit available for CVE-2025-6446?

Yes, a public proof-of-concept exploit is available for CVE-2025-6446. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6446?

Within 24 hours: Identify all systems running Client Details System 1.0 and assess their network exposure and data sensitivity. Within 7 days: Implement WAF rules to block SQL injection patterns in the /clientdetails/admin/index.php Username parameter, restrict admin interface access via network segmentation or IP whitelisting, and disable the admin panel if operationally feasible. Within 30 days: Contact vendor for patch timeline, evaluate replacement solutions, or plan migration to patched version once available.

PHP CVE-2025-6446

Q: What is the CVSS score of CVE-2025-6446?

CVE-2025-6446 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18825 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-21 cna@vuldb.com

PHP SQLi Client Details System Fabian

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 21:35 euvd

EUVD-2025-18825

Analysis Generated

Mar 15, 2026 - 21:35 vuln.today

PoC Detected

Oct 29, 2025 - 16:32 vuln.today

Public exploit code

CVE Published

Jun 21, 2025 - 23:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability, which was classified as critical, has been found in code-projects Client Details System 1.0. This issue affects some unknown processing of the file /clientdetails/admin/index.php. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

A critical SQL injection vulnerability exists in code-projects Client Details System version 1.0, specifically in the /clientdetails/admin/index.php file where the Username parameter is improperly validated. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has public exploit code available and demonstrates moderate real-world risk despite the critical classification, with a CVSS score of 7.3 indicating concrete but not maximum severity.

Technical ContextAI

The vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as 'Injection'), specifically manifesting as SQL injection. The Client Details System application fails to properly sanitize or parameterize the Username input parameter before incorporating it into SQL query construction in the /clientdetails/admin/index.php administrative interface. This is a classic improper input validation flaw where user-supplied data is concatenated directly into SQL statements without escaping, prepared statements, or input validation. The affected technology stack involves PHP-based web application processing with backend SQL database interaction, likely MySQL or similar RDBMS.

RemediationAI

Immediate remediation steps: (1) Apply vendor patch if available from code-projects; check their official website/repositories for security updates to version 1.1 or later; (2) If no patch is immediately available, implement input validation: use prepared statements/parameterized queries for all SQL operations involving the Username parameter; (3) Input sanitization: whitelist acceptable Username characters (alphanumeric, common separators); reject special SQL metacharacters; (4) Web Application Firewall (WAF) rules: deploy WAF signatures blocking common SQL injection patterns (UNION, SELECT, OR 1=1, etc.) targeting /clientdetails/admin/index.php; (5) Temporary mitigation: restrict /clientdetails/admin/ access via network/firewall rules to trusted IP addresses only; (6) Database-level: implement least-privilege database user accounts with minimal required SQL permissions; (7) Monitoring: implement SQL query logging and anomaly detection to identify exploitation attempts; (8) Long-term: migrate away from code-projects Client Details System 1.0 if vendor does not provide timely security updates, as legacy software with this vulnerability class presents sustained risk.