Which versions of PHP are affected by EUVD-2025-18722?

A publicly disclosed SQL injection vulnerability in Online Shoe Store 1.0 allows remote attackers to manipulate customer data and potentially gain unauthorized access to the database.

Is there a public PoC exploit available for EUVD-2025-18722?

Yes, a public proof-of-concept exploit is available for EUVD-2025-18722. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2025-18722?

Within 24 hours: Immediately disable or restrict access to /function/edit_customer.php; verify if your organization uses code-projects Online Shoe Store 1.0 and isolate affected systems from production networks if confirmed. Within 7 days: Implement WAF rules blocking SQL injection patterns in the firstname parameter and related fields; conduct database audit for unauthorized access or data exfiltration. Within 30 days: Evaluate migration to patched versions or alternative solutions; perform full application security assessment; implement input validation and prepared statement code review.

PHP EUVD-2025-18722

Q: What is the CVSS score of EUVD-2025-18722?

EUVD-2025-18722 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2025-6307 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-20 cna@vuldb.com

PHP SQLi Online Shoe Store Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-18722

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

PoC Detected

Jun 26, 2025 - 21:18 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 05:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Online Shoe Store 1.0. It has been rated as critical. This issue affects some unknown processing of the file /function/edit_customer.php. The manipulation of the argument firstname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

AnalysisAI

CVE-2025-6307 is a critical SQL injection vulnerability in code-projects Online Shoe Store 1.0 affecting the /function/edit_customer.php file, where the 'firstname' parameter is insufficiently sanitized, allowing remote unauthenticated attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with proof-of-concept details available, and while rated 7.3 (High) in CVSS v3.1, the network-accessible attack vector combined with no authentication requirement and demonstrated public exploitation significantly elevates real-world risk. Other parameters in the same function are suspected to be vulnerable to the same injection pattern.

Technical ContextAI

This vulnerability stems from CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), specifically manifesting as SQL injection in a PHP web application. The affected endpoint /function/edit_customer.php processes user-supplied input from the 'firstname' parameter without proper parameterized queries, prepared statements, or input validation, allowing attackers to inject malicious SQL syntax directly into database queries. The Online Shoe Store application (CPE: cpe:2.3:a:code-projects:online_shoe_store:1.0:*:*:*:*:*:*:*) is a PHP-based e-commerce platform where customer data modification functionality has been inadequately protected against injection attacks. The vulnerability likely affects other customer attribute parameters (lastname, email, phone, etc.) that follow similar unsafe coding patterns within the same file.

RemediationAI

Immediate Mitigation: Disable or restrict access to /function/edit_customer.php until patching is available using web application firewall (WAF) rules or web server configuration Code-Level Patch: Replace all SQL query construction in edit_customer.php with parameterized prepared statements using PHP PDO or mysqli prepared statements: use placeholders (?) or named parameters instead of string concatenation Input Validation: Implement strict whitelist validation for the firstname parameter: allow only alphanumeric characters, hyphens, apostrophes, and spaces; enforce length limits (max 50 characters) Defense in Depth: Apply principle of least privilege to database user account: restrict permissions to only SELECT, UPDATE operations needed for customer editing, remove DROP/ALTER/EXEC permissions Upgrade Path: Contact code-projects vendor for patch or security update; if unavailable, consider migration to alternative e-commerce platforms with active security support Detection: Implement Web Application Firewall rules to detect and block SQL injection patterns in edit_customer.php requests; monitor database query logs for unusual SQL syntax