Which versions of PHP are affected by CVE-2025-6502?

A publicly disclosed SQL injection vulnerability in the Inventory Management System 1.0 allows remote attackers to manipulate database queries through the password change function, potentially…

Is there a public PoC exploit available for CVE-2025-6502?

Yes, a public proof-of-concept exploit is available for CVE-2025-6502. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6502?

Within 24 hours: Isolate the Inventory Management System from production if possible; implement Web Application Firewall (WAF) rules to block requests containing SQL injection payloads targeting /php_action/changePassword.php; disable the password change functionality if business-critical alternatives exist. Within 7 days: Conduct forensic analysis of access logs for exploitation attempts; implement network segmentation to restrict access to the application; deploy input validation and parameterized queries as code-level mitigations if internal development resources are available. Within 30 days: Contact vendor for patch availability and timeline; evaluate replacement solutions; perform comprehensive security assessment of the application codebase for similar vulnerabilities.

PHP CVE-2025-6502

Q: What is the CVSS score of CVE-2025-6502?

CVE-2025-6502 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18864 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-23 cna@vuldb.com

PHP SQLi Inventory Management System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 22:10 euvd

EUVD-2025-18864

Analysis Generated

Mar 15, 2026 - 22:10 vuln.today

PoC Detected

Jun 27, 2025 - 16:56 vuln.today

Public exploit code

CVE Published

Jun 23, 2025 - 04:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /php_action/changePassword.php. The manipulation of the argument user_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6502 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/changePassword.php file where the user_id parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit details available, increasing immediate risk of active exploitation.

Technical ContextAI

This vulnerability stems from improper input validation in a PHP-based web application (CPE: cpe:2.3:a:code-projects:inventory_management_system:1.0:*:*:*:*:*:*:*). The root cause is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), indicating that user-supplied input in the user_id parameter is passed directly to SQL queries without proper parameterization or escaping. The affected file changePassword.php likely constructs SQL statements dynamically using string concatenation rather than prepared statements with parameterized queries, a fundamental PHP security anti-pattern. This is a server-side vulnerability requiring no client-side interaction, making it particularly dangerous in web application contexts.

RemediationAI

patch: Upgrade to patched version when available from code-projects. Monitor official vendor channels for security updates. immediate_mitigation: Implement Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting /php_action/changePassword.php, particularly patterns in user_id parameter (union, select, or, drop, etc.). code_level_fix: Refactor changePassword.php to use prepared statements with parameterized queries. Replace string concatenation in SQL queries with bind parameters (mysqli prepared statements or PDO). input_validation: Implement strict input validation: user_id should be validated as numeric (integer only) before any database operation. Use type casting: (int)$_POST['user_id'] or similar strict validation. access_control: If possible, implement rate limiting and IP-based restrictions on /php_action/changePassword.php endpoint to reduce attack surface until patched. monitoring: Enable SQL error logging and monitor for suspicious SQL syntax errors in application logs that may indicate exploitation attempts.