EUVD-2025-19138CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /php_action/editBrand.php. The manipulation of the argument editBrandStatus leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-6665 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/editBrand.php file's editBrandStatus parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with a proof-of-concept available, increasing real-world exploitation risk.
Technical Context
The vulnerability stems from improper input validation and parameterization in PHP server-side code (CWE-74: Improper Neutralization of Special Elements in Output). The editBrand.php file fails to properly sanitize or use prepared statements for the editBrandStatus parameter before incorporating it into SQL queries. This classic SQL injection flaw allows attackers to break out of the intended query context and inject arbitrary SQL commands. The affected technology is a PHP-based inventory management system with a likely MySQL or similar relational database backend. CPE identifier would be: cpe:2.3:a:code-projects:inventory_management_system:1.0:*:*:*:*:*:*:*
Affected Products
Inventory Management System (['1.0'])
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today