Which versions of PHP are affected by CVE-2025-7535?

A publicly disclosed SQL injection vulnerability in Campcodes Sales and Inventory System 1.0 allows remote attackers to manipulate database queries through the reprint_cash.php file.

Is there a public PoC exploit available for CVE-2025-7535?

Yes, a public proof-of-concept exploit is available for CVE-2025-7535. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-7535?

Within 24 hours: Isolate affected systems from production networks or restrict access to trusted networks only; document all users with access to the vulnerable application. Within 7 days: Deploy WAF rules to block SQL injection patterns targeting /pages/reprint_cash.php; implement input validation and sanitization at the application layer; conduct database access audit for suspicious activity. Within 30 days: Evaluate migration to alternative inventory management solutions; contact vendor for patch timeline; perform full security assessment of Campcodes deployment for additional vulnerabilities.

PHP CVE-2025-7535

Q: What is the CVSS score of CVE-2025-7535?

CVE-2025-7535 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-21264 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-13 cna@vuldb.com

PHP SQLi Sales And Inventory System Campcodes

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 09:18 euvd

EUVD-2025-21264

Analysis Generated

Mar 16, 2026 - 09:18 vuln.today

PoC Detected

Jul 16, 2025 - 14:55 vuln.today

Public exploit code

CVE Published

Jul 13, 2025 - 18:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /pages/reprint_cash.php. The manipulation of the argument sid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7535 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System version 1.0, located in the /pages/reprint_cash.php file's 'sid' parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploits available, making it an immediate threat to deployed instances.

Technical ContextAI

The vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as 'Injection'), specifically SQL injection. The vulnerable code in /pages/reprint_cash.php fails to properly sanitize or parameterize the 'sid' (likely Session ID or Sales ID) parameter before using it in SQL queries. Campcodes Sales and Inventory System is a PHP-based web application (implied by .php file extension) that manages sales transactions and inventory. The lack of input validation allows attackers to inject malicious SQL syntax directly into database queries. The affected CPE would be: cpe:2.3:a:campcodes:sales_and_inventory_system:1.0:*:*:*:*:*:*:*

RemediationAI

{'type': 'patch', 'recommendation': 'Upgrade Campcodes Sales and Inventory System beyond version 1.0. Check vendor website (campcodes.com or official repository) for patched version release. Version 1.0 is legacy; patches may be available as 1.1 or 2.0.', 'priority': 'CRITICAL'} {'type': 'immediate_workaround', 'steps': ['Disable or restrict access to /pages/reprint_cash.php at the web server level (firewall rule, Apache/Nginx configuration) until patch is applied', "Implement Web Application Firewall (WAF) rules to block SQL injection patterns in the 'sid' parameter (e.g., detecting single quotes, UNION, SELECT keywords)", "Implement input validation: whitelist alphanumeric characters only for 'sid' parameter; reject any special characters"]} {'type': 'defensive_coding_fix', 'steps': ['Replace direct SQL concatenation with parameterized queries (prepared statements) using mysqli or PDO with bound parameters', "Example: Use $stmt = $mysqli->prepare('SELECT * FROM sales WHERE sid = ?'); $stmt->bind_param('s', $sid); instead of string interpolation", 'Implement output encoding/escaping for any reflected data']} {'type': 'detection_and_monitoring', 'steps': ['Enable SQL error logging to detect injection attempts', 'Monitor /pages/reprint_cash.php access logs for suspicious patterns (URL encoding anomalies, SQL keywords)', 'Implement database activity monitoring (DAM) to detect unusual query patterns']}