Which versions of PHP are affected by CVE-2025-6501?

A publicly disclosed SQL injection vulnerability in the Inventory Management System 1.0 allows unauthenticated attackers to remotely compromise the database through the categories management feature.

Is there a public PoC exploit available for CVE-2025-6501?

Yes, a public proof-of-concept exploit is available for CVE-2025-6501. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6501?

Within 24 hours: Isolate or disable the affected /php_action/createCategories.php endpoint; implement network-level access controls limiting exposure to trusted networks only; enable database query logging. Within 7 days: Deploy a Web Application Firewall (WAF) rule blocking SQL injection patterns in the categoriesStatus parameter; conduct database forensics for signs of exploitation; inventory all systems running version 1.0. Within 30 days: Evaluate migration to a patched version or alternative inventory management solution; implement input validation and parameterized queries as interim code fixes; conduct security assessment of the entire application.

PHP CVE-2025-6501

Q: What is the CVSS score of CVE-2025-6501?

CVE-2025-6501 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-28742 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-23 cna@vuldb.com

PHP SQLi Inventory Management System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 22:10 euvd

EUVD-2025-28742

Analysis Generated

Mar 15, 2026 - 22:10 vuln.today

PoC Detected

Jun 27, 2025 - 16:57 vuln.today

Public exploit code

CVE Published

Jun 23, 2025 - 03:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability, which was classified as critical, was found in code-projects Inventory Management System 1.0. This affects an unknown part of the file /php_action/createCategories.php. The manipulation of the argument categoriesStatus leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6501 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 affecting the /php_action/createCategories.php file, where the 'categoriesStatus' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. Public exploit disclosure and proof-of-concept availability indicate active threat potential with low barrier to exploitation.

Technical ContextAI

This vulnerability exists in a PHP-based web application (Inventory Management System) that processes user input from the 'categoriesStatus' parameter without adequate input validation or parameterized query protection. The root cause is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), which is a parent category encompassing SQL injection (CWE-89). The vulnerable code path in /php_action/createCategories.php likely constructs SQL queries through string concatenation rather than using prepared statements or parameterized queries. The application stack involves PHP with an underlying database system (likely MySQL/MariaDB based on common IMS implementations), where unsanitized user input flows directly into dynamic SQL construction.

RemediationAI

Immediate steps: (1) ISOLATE - Restrict network access to /php_action/createCategories.php via WAF rules, IP whitelisting, or application firewall to trusted internal subnets only; (2) INPUT VALIDATION - Implement strict whitelist validation for 'categoriesStatus' parameter (e.g., accept only predefined enumerated values like 'active', 'inactive'); (3) PARAMETERIZED QUERIES - Rewrite the vulnerable query construction to use prepared statements with parameterized queries (PHP mysqli prepared statements or PDO prepared statements with bound parameters); (4) UPGRADE - Contact code-projects for security patches; if unavailable, consider migrating to maintained inventory management systems. Long-term: (1) Conduct a code audit of all PHP files handling user input, particularly in /php_action/ directory; (2) implement ORM frameworks (e.g., Doctrine, Eloquent) that abstract SQL construction; (3) deploy Web Application Firewall (WAF) rules for SQL injection pattern detection; (4) implement rate limiting and logging on createCategories.php endpoint; (5) run automated security scanning (SAST) in the CI/CD pipeline.