EUVD-2025-18716Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was found in code-projects Online Shoe Store 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/admin_index.php. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
CVE-2025-6306 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, affecting the admin authentication mechanism in /admin/admin_index.php. An unauthenticated remote attacker can manipulate the Username parameter to execute arbitrary SQL queries, potentially leading to unauthorized access, data theft, or data manipulation. The vulnerability has been publicly disclosed with working exploits available, making active exploitation likely.
Technical ContextAI
The vulnerability stems from CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), specifically SQL injection in the authentication layer. The /admin/admin_index.php file fails to properly sanitize or parameterize user-supplied input in the Username parameter before incorporating it into SQL queries. This is a classic first-order SQL injection vulnerability where attacker-controlled data is directly concatenated into dynamic SQL statements without prepared statements, input validation, or escaping. The root cause is improper input handling in server-side code that constructs database queries, allowing attackers to break out of the intended SQL syntax and execute arbitrary commands.
RemediationAI
Immediate actions: (1) Implement parameterized queries/prepared statements in /admin/admin_index.php—replace all dynamic SQL string concatenation with prepared statements using bound parameters (e.g., mysqli_prepare or PDO with placeholders); (2) Add server-side input validation on the Username field (whitelist alphanumeric characters, reject SQL metacharacters); (3) Apply principle of least privilege to database credentials used by the application; (4) Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the Username parameter as interim protection. Long-term: Update to a patched version once released (vendor should provide v1.1 or later), or migrate to a maintained e-commerce platform. If no patch is available from code-projects, consider applying a comprehensive code review and security remediation internally or engaging a security vendor.
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Share
External POC / Exploit Code
Leaving vuln.today