Which versions of PHP are affected by CVE-2025-6503?

An unauthenticated SQL injection vulnerability in the Inventory Management System 1.0 allows attackers to remotely compromise the database, potentially exposing sensitive inventory and business data.

Is there a public PoC exploit available for CVE-2025-6503?

Yes, a public proof-of-concept exploit is available for CVE-2025-6503. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6503?

Within 24 hours: Isolate affected systems from production networks and disable the Inventory Management System if not critical to operations; audit logs for exploitation attempts. Within 7 days: Implement WAF rules to block malicious requests to /php_action/fetchSelectedCategories.php; conduct database integrity audit and review user access logs. Within 30 days: Identify and deploy vendor security update when available; evaluate migration to alternative inventory management solutions if patching timeline extends beyond acceptable risk tolerance.

PHP CVE-2025-6503

Q: What is the CVSS score of CVE-2025-6503?

CVE-2025-6503 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18863 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-23 cna@vuldb.com

PHP SQLi Inventory Management System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 22:10 euvd

EUVD-2025-18863

Analysis Generated

Mar 15, 2026 - 22:10 vuln.today

PoC Detected

Jun 27, 2025 - 16:55 vuln.today

Public exploit code

CVE Published

Jun 23, 2025 - 04:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Inventory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /php_action/fetchSelectedCategories.php. The manipulation of the argument categoriesId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6503 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/fetchSelectedCategories.php file where the 'categoriesId' parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The exploit has been publicly disclosed and proof-of-concept code is available, significantly elevating exploitation risk in production environments.

Technical ContextAI

This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as 'Injection'), which represents a failure to properly validate and sanitize user-supplied input before incorporating it into SQL queries. The affected component is a PHP file (/php_action/fetchSelectedCategories.php) that likely processes category filtering requests in an inventory management application. The 'categoriesId' parameter is passed directly or with insufficient escaping into SQL query construction, allowing an attacker to inject malicious SQL syntax. This is a classic first-order SQL injection vulnerability in legacy PHP applications that predate parameterized query adoption.

RemediationAI

Immediate remediation steps: (1) Implement prepared statements/parameterized queries using mysqli_prepare() or PDO prepared statements in the fetchSelectedCategories.php file; (2) Apply strict input validation using whitelist approach for categoriesId parameter (numeric validation only if categories are referenced by ID); (3) Implement stored procedures with bound parameters if database layer supports; (4) Apply Web Application Firewall (WAF) rules to block SQL injection patterns in the categoriesId parameter as temporary mitigation; (5) Upgrade to a patched version when released by code-projects vendor. Contact code-projects development team for security updates; if no response within 90 days, consider migrating to actively maintained inventory management systems. Implement principle of least privilege for database user credentials used by the application.