Which versions of PHP are affected by CVE-2025-6611?

A critical SQL injection vulnerability in the Inventory Management System 1.0 allows unauthenticated remote attackers to manipulate database queries through the brand status parameter, potentially…

Is there a public PoC exploit available for CVE-2025-6611?

Yes, a public proof-of-concept exploit is available for CVE-2025-6611. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6611?

Within 24 hours: Take the affected system offline or restrict network access to trusted IPs only; notify all stakeholders and document the impact assessment. Within 7 days: Deploy a Web Application Firewall (WAF) rule to block requests containing SQL injection patterns in the brandStatus parameter; implement input validation and prepared statements if code modifications are possible; contact the vendor for patch availability and timeline. Within 30 days: Migrate to a patched version when available or replace the system with a supported alternative; conduct a full security audit of the Inventory Management System and related infrastructure; review database access logs for potential compromise.

PHP CVE-2025-6611

Q: What is the CVSS score of CVE-2025-6611?

CVE-2025-6611 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-19110 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-25 cna@vuldb.com

PHP SQLi Inventory Management System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2025-19110

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

PoC Detected

Jun 27, 2025 - 18:35 vuln.today

Public exploit code

CVE Published

Jun 25, 2025 - 16:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Inventory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /php_action/createBrand.php. The manipulation of the argument brandStatus leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6611 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 affecting the /php_action/createBrand.php endpoint via the brandStatus parameter. The vulnerability allows unauthenticated remote attackers to manipulate SQL queries, potentially resulting in unauthorized data access, modification, or deletion. Public exploit disclosure and active exploitation risk are confirmed.

Technical ContextAI

The vulnerability exists in PHP-based web application code (specifically createBrand.php) that fails to properly sanitize or parameterize user input in the brandStatus parameter before constructing SQL queries. This is a classic CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection') vulnerability. The root cause is likely missing input validation, lack of prepared statements, or inadequate escaping of SQL special characters. The affected product is code-projects Inventory Management System v1.0, a PHP-based inventory management application. The attack surface is exposed through a publicly accessible web endpoint with no authentication requirement (PR:N in CVSS).

RemediationAI

IMMEDIATE: Disable or restrict access to /php_action/createBrand.php via web application firewall (WAF) rules until patch is available.
Apply input validation: Implement strict whitelisting for brandStatus parameter (e.g., only allow alphanumeric characters or specific enum values).
Use prepared statements/parameterized queries: Replace all direct SQL string concatenation with parameterized queries using bound variables in PHP (MySQLi prepared statements or PDO prepared statements).
Implement output encoding: Ensure all user input is properly escaped using context-appropriate escaping functions (e.g., mysqli_real_escape_string or prepared statements).
Monitor vendor advisories: Check code-projects official repository/website for security patches to Inventory Management System v1.0. If no patch is available, consider migrating to a maintained alternative or hardening via WAF rules.
Apply principle of least privilege: Ensure database user executing createBrand.php queries has minimal required permissions (no DROP/ALTER TABLE rights).
Conduct security testing: Perform SQL injection testing on all similar endpoints (other /php_action/*.php files with user-controlled parameters) to identify related vulnerabilities.