EUVD-2025-19517Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated SQLi allows full database access, so high impact and network vector.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability classified as critical has been found in code-projects Inventory Management System 1.0. Affected is an unknown function of the file /php_action/createUser.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
SQL injection in code-projects Inventory Management System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter in /php_action/createUser.php, leading to unauthorized data access or modification. Public exploit code is available (GitHub issue), but the EPSS exploitation probability is low (0.05%). The vulnerability is classified as critical despite a moderate CVSS base score, and no vendor-released patch has been identified.
Technical ContextAI
The vulnerability is a SQL injection (CWE-74) in a PHP-based inventory management system. The affected endpoint /php_action/createUser.php processes user-supplied input in the Username argument without proper sanitization or parameterized queries. The CPE (cpe:2.3:a:code-projects:inventory_management_system:1.0) confirms the exact product and version. SQL injection allows an attacker to inject arbitrary SQL commands into the underlying database, potentially compromising data integrity and confidentiality.
RemediationAI
No vendor-released patch has been identified for this vulnerability. As a compensating control, deploy a web application firewall (WAF) with rules to block SQL injection patterns in the Username parameter, or restrict access to the /php_action/createUser.php endpoint using IP whitelisting or authentication if possible. If source code access is available, modify the script to use prepared statements or parameterized queries to prevent injection. These mitigations may impact functionality if the endpoint is required for legitimate user creation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today