Which versions of PHP are affected by CVE-2025-7469?

A critical SQL injection vulnerability in Campcodes Sales and Inventory System 1.0 allows unauthenticated remote attackers to compromise database integrity and access sensitive business data.

Is there a public PoC exploit available for CVE-2025-7469?

Yes, a public proof-of-concept exploit is available for CVE-2025-7469. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-7469?

Within 24 hours: Identify all instances of Campcodes Sales and Inventory System 1.0 in your environment and assess which systems process customer or financial data. Within 7 days: Implement WAF rules blocking malicious input to /pages/product_add.php, restrict network access to the application to trusted networks only, and disable the product_add.php functionality if operationally feasible. Within 30 days: Plan migration to an alternative, actively maintained system or contact the vendor for an emergency patch; if no patch is released, begin decommissioning this application.

PHP CVE-2025-7469

Q: What is the CVSS score of CVE-2025-7469?

CVE-2025-7469 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-21216 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-12 cna@vuldb.com

PHP SQLi Sales And Inventory System Campcodes

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 08:56 euvd

EUVD-2025-21216

Analysis Generated

Mar 16, 2026 - 08:56 vuln.today

PoC Detected

Jul 15, 2025 - 15:32 vuln.today

Public exploit code

CVE Published

Jul 12, 2025 - 11:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. This issue affects some unknown processing of the file /pages/product_add.php. The manipulation of the argument prod_name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7469 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System 1.0 affecting the product addition functionality (/pages/product_add.php). An unauthenticated remote attacker can manipulate the 'prod_name' parameter to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation likely in the near term.

Technical ContextAI

The vulnerability exists in a PHP-based web application (Campcodes Sales and Inventory System) that processes user-supplied input without proper sanitization or parameterized query usage. The affected endpoint (/pages/product_add.php) likely constructs dynamic SQL queries by directly concatenating user input from the 'prod_name' parameter into SQL statements. This violates CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection') and relates to broader SQL injection patterns (CWE-89). The root cause is insufficient input validation and lack of prepared statements or parameterized queries. The application likely uses PHP with MySQL/MariaDB backend based on typical small business inventory system architecture.

RemediationAI

Immediate remediation steps: (1) Upgrade Campcodes Sales and Inventory System to version 1.1 or later if available (verify vendor release notes for patch availability - not provided in base data), (2) If no patch exists, implement input validation by whitelisting allowed characters in prod_name (alphanumeric, spaces, hyphens only) and reject special SQL characters (quotes, semicolons, dashes, asterisks), (3) Refactor /pages/product_add.php to use prepared statements with parameterized queries (mysqli_prepare() or PDO with bound parameters) instead of string concatenation, (4) Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in prod_name parameter, (5) Apply principle of least privilege - ensure database user account used by application has minimal permissions (INSERT/SELECT only, no DROP/ALTER), (6) Conduct code audit of all other input-handling PHP files for similar injection vulnerabilities. Contact Campcodes support/repository for official patch status.