EUVD-2025-19466Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess the target web application
-
DeliveryDeliver a poisoned orderId parameter in an HTTP request to /php_action/editPayment.php
-
ExploitInject SQL payload into the backend query
-
ExecutionExecute unauthorized database commands
-
ImpactExfiltrate or corrupt application data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions are required - remote unauthenticated access to the /php_action/editPayment.php script is sufficient. The CVSS vector indicates no privileges (PR:N) and no user interaction (UI:N), so any network-level access to the application allows exploitation against default installations of Inventory Management System 1.0. |
| Impact | According to the published CVSS 4.0 vector, the attack is network-based (AV:N), with low complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), and low impact across all three axes (VC:L/VI:L/VA:L) with no scope change. The EPSS score of 0.08% (25th percentile) suggests a very low probability of real-world exploitation. The vulnerability is not in the CISA KEV catalog, confirming no known active exploitation. While public proof-of-concept code exists, the combination of low impact and low exploitation probability indicates this issue is a low-risk SQL injection in a niche product, not a high-priority threat. There are no conflicting signals; the low CVSS score aligns with the limited impact described. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP request to /php_action/editPayment.php with a malicious orderId value containing SQL metacharacters. The injected payload modifies the intended SQL query, enabling the attacker to exfiltrate database tables, modify records, or bypass authentication logic. Public exploit references at GitHub confirm the technique. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
SQL injection in Inventory Management System 1.0 allows unauthorized database manipulation via the orderId parameter. An unauthenticated remote attacker can exploit the /php_action/editPayment.php endpoint to execute arbitrary SQL statements. Public exploit code is available, though no active exploitation has been confirmed, and the EPSS probability is low.
Earlier versions of this analysis (1)
RemediationAI
No vendor-released patch has been identified at the time of analysis. As a workaround, implement parameterized queries or stored procedures to neutralize SQL injection in the editPayment.php script. Additionally, restrict network access to the affected endpoint, or deploy a web application firewall (WAF) with rules that detect SQL injection patterns in the orderId parameter. If feasible, disable the editPayment.php functionality until the underlying code can be fixed. These mitigations may reduce functionality and require developer effort.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in a PHP-based Inventory Management System (code-projects, version 1.0) where the file /php_action/editPayment.php directly incorporates user input from the orderId argument into a SQL query without proper sanitization. This improper neutralization of special elements, classified as CWE-74, enables SQL injection. The affected product is identified by CPE cpe:2.3:a:code-projects:inventory_management_system:1.0:*:*:*:*:*:*:*.
Know when Inventory Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network attack, no privileges, low complexity; SQL injection typically impacts confidentiality and integrity but not availability.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in code-projects Inventory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /php_action/editPayment.php. The manipulation of the argument orderId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Organizations using A vulnerability face moderate risk from CVE-2025-6834, a injection vulnerability rated CVSS 7.3. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. Proof-of-concept code is publicly available, increasing the risk of exploitation. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Inventory Management System
View allA vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Rated cr
A vulnerability classified as critical was found in SourceCodester Inventory Management System 1.0. Rated critical sever
A vulnerability, which was classified as critical, has been found in SourceCodester Inventory Management System 1.0.php.
A vulnerability was found in SourceCodester Inventory Management System 1.0 and classified as critical.php. Rated critic
A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as critical. Rated criti
Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control. Rated hi
A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. Rated high severity (C
A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Rated hi
A vulnerability classified as critical has been found in SourceCodester Inventory Management System 1.0. Rated critical
A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as critical. Rated criti
A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Rated cr
A vulnerability was found in SourceCodester Inventory Management System 1.0 and classified as critical.php. Rated critic
Exploit-DB