Which versions of PHP are affected by CVE-2025-6612?

A publicly disclosed SQL injection vulnerability affecting Inventory Management System 1.0 allows remote attackers to manipulate database queries through the category removal function, potentially…

Is there a public PoC exploit available for CVE-2025-6612?

Yes, a public proof-of-concept exploit is available for CVE-2025-6612. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6612?

Within 24 hours: Identify all instances of Inventory Management System 1.0 in production and isolate them from untrusted networks or disable the /php_action/removeCategories.php endpoint. Within 7 days: Implement Web Application Firewall (WAF) rules to block malicious SQL injection patterns in the categoriesId parameter, conduct database access logs review for exploitation attempts, and evaluate migration to patched or alternative solutions. Within 30 days: Complete transition away from the vulnerable system, apply any interim patches if released by vendor, or decommission the application entirely.

PHP CVE-2025-6612

Q: What is the CVSS score of CVE-2025-6612?

CVE-2025-6612 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-19109 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-25 cna@vuldb.com

PHP SQLi Inventory Management System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2025-19109

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

PoC Detected

Jun 27, 2025 - 18:22 vuln.today

Public exploit code

CVE Published

Jun 25, 2025 - 16:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /php_action/removeCategories.php. The manipulation of the argument categoriesId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6612 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 affecting the /php_action/removeCategories.php endpoint. An unauthenticated remote attacker can manipulate the 'categoriesId' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available and demonstrates active exploitation potential with a CVSS 7.3 score indicating moderate-to-high severity.

Technical ContextAI

This vulnerability exists in a PHP-based Inventory Management System where user-supplied input (categoriesId parameter) is improperly validated and directly incorporated into SQL queries without parameterized prepared statements or proper escaping. The root cause is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), representing a classic SQL injection flaw. The vulnerable endpoint /php_action/removeCategories.php processes category deletion operations, and the lack of input sanitization allows attackers to break out of intended SQL syntax and inject malicious SQL commands. The absence of stored procedures or parameterized queries indicates the code likely uses string concatenation for query building.

RemediationAI

Immediate actions: (1) Implement input validation on the categoriesId parameter - whitelist only valid numeric identifiers and reject any input containing SQL metacharacters; (2) Use parameterized prepared statements (prepared queries with bound parameters) for all database interactions in removeCategories.php; (3) Apply principle of least privilege to database user accounts - ensure the PHP application's database credentials have minimal required permissions; (4) Implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in category-related parameters; (5) Upgrade to patched version if available from code-projects vendor (check project repository/advisory page); (6) As interim mitigation, disable or restrict access to /php_action/removeCategories.php at the web server level using .htaccess or nginx configuration if the functionality is not immediately required. Long-term: refactor the entire application to use an ORM framework (Laravel Eloquent, Doctrine) that enforces parameterized queries by default.