Which versions of PHP are affected by CVE-2025-6500?

A remote SQL injection vulnerability in the Inventory Management System 1.0 allows attackers to manipulate database queries through the category editing function, potentially exposing or modifying…

Is there a public PoC exploit available for CVE-2025-6500?

Yes, a public proof-of-concept exploit is available for CVE-2025-6500. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6500?

Within 24 hours: Immediately disable the /php_action/editCategories.php endpoint or restrict access to trusted internal networks only. Within 7 days: Deploy a Web Application Firewall (WAF) rule to block SQL injection patterns in the editCategoriesName parameter, and conduct a database audit for unauthorized access or modifications. Within 30 days: Plan migration to a patched version or replacement system; evaluate code-in-place fixes if the vendor provides interim guidance.

PHP CVE-2025-6500

Q: What is the CVSS score of CVE-2025-6500?

CVE-2025-6500 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18862 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-23 cna@vuldb.com

PHP SQLi Inventory Management System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 22:10 euvd

EUVD-2025-18862

Analysis Generated

Mar 15, 2026 - 22:10 vuln.today

PoC Detected

Jun 27, 2025 - 16:58 vuln.today

Public exploit code

CVE Published

Jun 23, 2025 - 03:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability, which was classified as critical, has been found in code-projects Inventory Management System 1.0. Affected by this issue is some unknown functionality of the file /php_action/editCategories.php. The manipulation of the argument editCategoriesName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6500 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/editCategories.php file where the 'editCategoriesName' parameter is inadequately sanitized. An unauthenticated attacker can exploit this remotely to read, modify, or delete database contents, affecting confidentiality, integrity, and availability. Public exploit disclosure and confirmed proof-of-concept availability increase real-world risk significantly.

Technical ContextAI

The vulnerability exists in a PHP-based Inventory Management System (CPE: cpe:2.3:a:code-projects:inventory_management_system:1.0:*:*:*:*:*:*:*) at the application entry point /php_action/editCategories.php. The root cause is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), specifically manifesting as SQL injection (CWE-89). The editCategoriesName parameter is passed directly into SQL queries without parameterized statements or input validation, allowing attackers to inject arbitrary SQL commands. This is a server-side code injection flaw in the PHP backend that directly impacts the database layer.

RemediationAI

Update Inventory Management System to version 1.1 or later (if available from vendor). Contact code-projects for patched release or security advisories.; priority: Critical Workaround - Input Validation: Implement strict input validation on editCategoriesName: whitelist alphanumeric characters and safe symbols only; reject any input containing SQL keywords or special characters (quotes, semicolons, dashes, asterisks). Workaround - Prepared Statements: Rewrite the PHP code in editCategories.php to use prepared statements or parameterized queries (mysqli prepared statements or PDO prepared statements) instead of string concatenation for SQL queries. Workaround - WAF Rule: Deploy a Web Application Firewall (WAF) rule to block requests to /php_action/editCategories.php containing SQL injection payloads (e.g., keywords: UNION, SELECT, DROP, INSERT, DELETE when present in editCategoriesName parameter). Workaround - Least Privilege: Configure database user account running PHP application with minimal required permissions (no DROP, DELETE on critical tables if category edits only require INSERT/UPDATE). Monitoring: Monitor application logs and database query logs for unusual SQL patterns or failed queries to /php_action/editCategories.php; implement IDS/IPS signatures for CVE-2025-6500.