EUVD-2025-19138Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Impact | CVSS 7.3 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L indicates network-accessible, low-complexity, unauthenticated exploitation with moderate impact to confidentiality, integrity, and availability. The combination of public POC disclosure and confirmed exploitability significantly elevates real-world risk despite the 'moderate-to-high' rather than 'critical' CVSS score. The low attack complexity and no privilege requirement mean this is readily exploitable by unsophisticated threat actors. This is a HIGH PRIORITY vulnerability with strong exploitation signals: public disclosure, available POC, network vector, and no authentication required. SSVC analysis suggests immediate exploitation likelihood with automatable attack delivery. |
| Exploit ScenarioDerived | An attacker discovers the Inventory Management System 1.0 instance via public-facing web scanning. They send a crafted HTTP request to /php_action/editBrand.php with a malicious editBrandStatus parameter containing SQL injection payload, e.g., editBrandStatus=1' UNION SELECT username,password FROM admin_users-- or editBrandStatus=1; DROP TABLE brands;--. Due to the absence of input validation and prepared statements, the PHP backend directly incorporates this into the SQL query. The attacker can extract sensitive data (user credentials, product information), modify database records, or delete data without authentication. Given the public POC and low complexity, automated scanning and exploitation tools can rapidly identify and compromise unpatched instances. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 15, 2026
CVE-2025-6665 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/editBrand.php file's editBrandStatus parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with a proof-of-concept available, increasing real-world exploitation risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from improper input validation and parameterization in PHP server-side code (CWE-74: Improper Neutralization of Special Elements in Output). The editBrand.php file fails to properly sanitize or use prepared statements for the editBrandStatus parameter before incorporating it into SQL queries. This classic SQL injection flaw allows attackers to break out of the intended query context and inject arbitrary SQL commands. The affected technology is a PHP-based inventory management system with a likely MySQL or similar relational database backend. CPE identifier would be: cpe:2.3:a:code-projects:inventory_management_system:1.0:*:*:*:*:*:*:*
Know when Inventory Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /php_action/editBrand.php. The manipulation of the argument editBrandStatus leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
A remote SQL injection vulnerability in Inventory Management System 1.0 allows attackers to compromise database integrity and access sensitive inventory and business data without authentication. With public exploit code available and no vendor patch, immediate action is required to prevent unauthorized data exfiltration or manipulation of critical business records.
Within 24 hours: Identify all systems running Inventory Management System 1.0 and isolate them from production networks if possible; enable detailed logging on affected systems. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection payloads targeting /php_action/editBrand.php; implement input validation and parameterized queries if code modification is feasible. Within 30 days: Evaluate migration to a patched version or alternative inventory management solution; conduct database audit for unauthorized access or modifications.
Deploy WAF rules to filter SQL injection patterns in the editBrandStatus parameter; disable or restrict access to /php_action/editBrand.php functionality via network segmentation; implement database access controls and read-only permissions where possible; enable SQL query logging and real-time alerting for suspicious database activity; require multi-factor authentication for administrative access to the application.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Inventory Management System
View allA vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Rated cr
A vulnerability classified as critical was found in SourceCodester Inventory Management System 1.0. Rated critical sever
A vulnerability, which was classified as critical, has been found in SourceCodester Inventory Management System 1.0.php.
A vulnerability was found in SourceCodester Inventory Management System 1.0 and classified as critical.php. Rated critic
A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as critical. Rated criti
Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control. Rated hi
A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. Rated high severity (C
A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Rated hi
A vulnerability classified as critical has been found in SourceCodester Inventory Management System 1.0. Rated critical
A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as critical. Rated criti
A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Rated cr
A vulnerability was found in SourceCodester Inventory Management System 1.0 and classified as critical.php. Rated critic
Exploit-DB