Which versions of PHP are affected by CVE-2025-6668?

A publicly disclosed SQL injection vulnerability in Inventory Management System 1.0 allows remote attackers to potentially access, modify, or delete sensitive inventory data without authentication.

Is there a public PoC exploit available for CVE-2025-6668?

Yes, a public proof-of-concept exploit is available for CVE-2025-6668. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6668?

Within 24 hours: Isolate affected Inventory Management System instances from production networks or disable the /php_action/fetchSelectedBrand.php endpoint; verify if your organization is using version 1.0 and identify all systems in scope. Within 7 days: Implement WAF rules to block SQL injection attempts against the brandId parameter; conduct urgent assessment of whether sensitive data was accessed; evaluate immediate replacement or upgrade options with the vendor. Within 30 days: Complete migration to a patched version or alternative solution; perform forensic review of database access logs for exploitation indicators; establish a vendor communication channel for patch ETA.

PHP CVE-2025-6668

Q: What is the CVSS score of CVE-2025-6668?

CVE-2025-6668 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-19140 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-25 cna@vuldb.com

PHP SQLi Inventory Management System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2025-19140

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

PoC Detected

Jun 27, 2025 - 17:49 vuln.today

Public exploit code

CVE Published

Jun 25, 2025 - 22:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Inventory Management System 1.0. It has been classified as critical. This affects an unknown part of the file /php_action/fetchSelectedBrand.php. The manipulation of the argument brandId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6668 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 affecting the /php_action/fetchSelectedBrand.php endpoint via the brandId parameter. An unauthenticated remote attacker can exploit this vulnerability to read, modify, or delete database contents, with disclosed public exploits and active exploitation potential. The CVSS 7.3 score reflects moderate impact across confidentiality, integrity, and availability, though the attack requires no privileges or user interaction.

Technical ContextAI

The vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection') manifesting as SQL injection. The affected component is a PHP backend script (/php_action/fetchSelectedBrand.php) that processes the 'brandId' parameter without proper input validation or parameterized query preparation. This is typical of legacy PHP applications that concatenate user input directly into SQL queries. The vulnerability affects code-projects Inventory Management System version 1.0, a web-based PHP application commonly deployed in small-to-medium business environments. Affected CPE would be: cpe:2.3:a:code-projects:inventory_management_system:1.0:*:*:*:*:*:*:*

RemediationAI

Immediate actions: (1) Apply vendor patches if available from code-projects (verify at https://github.com/code-projects/ or vendor portal); (2) If patches unavailable, implement input validation on the brandId parameter using whitelisting (numeric validation if brandId is expected to be numeric); (3) Replace all dynamic SQL with parameterized prepared statements using PHP PDO or mysqli prepared statements; (4) Apply Web Application Firewall (WAF) rules to block SQL injection payloads; (5) Restrict network access to /php_action/fetchSelectedBrand.php via IP whitelisting or VPN; (6) Audit database logs for suspicious query patterns. Long-term: upgrade to a maintained inventory management system or establish a security patch management process with the vendor.