Which versions of PHP are affected by EUVD-2025-18730?

A public SQL injection vulnerability in the Online Shoe Store admin panel (CVE-2025-6317) allows unauthenticated attackers to remotely compromise the database, potentially exposing customer data and…

Is there a public PoC exploit available for EUVD-2025-18730?

Yes, a public proof-of-concept exploit is available for EUVD-2025-18730. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2025-18730?

Within 24 hours: Disable or restrict access to /admin/confirm.php via firewall/WAF rules; identify all instances of this application in your environment and prioritize exposed systems for immediate remediation. Within 7 days: Implement input validation/WAF rules to block SQL injection payloads on the ID parameter; conduct database audit for unauthorized access or data exfiltration; prepare customer communication if breach suspected. Within 30 days: Replace or upgrade to patched version when vendor releases; if no patch emerges, evaluate retiring this application and migrating to maintained alternatives; conduct full security assessment of affected systems.

PHP EUVD-2025-18730

Q: What is the CVSS score of EUVD-2025-18730?

EUVD-2025-18730 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2025-6317 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-20 cna@vuldb.com

PHP SQLi Online Shoe Store Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-18730

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

PoC Detected

Jun 26, 2025 - 21:09 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 08:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability classified as critical has been found in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /admin/confirm.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6317 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, affecting the /admin/confirm.php file's ID parameter. An unauthenticated remote attacker can execute arbitrary SQL commands with low complexity, potentially leading to unauthorized data access, modification, or service disruption. Public exploit disclosure and active attack feasibility significantly elevate real-world risk despite the moderate CVSS score of 7.3.

Technical ContextAI

The vulnerability stems from CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), specifically manifesting as SQL injection in a PHP-based e-commerce application. The /admin/confirm.php file fails to properly sanitize or parameterize user-supplied input in the ID parameter before incorporating it into SQL queries. This is a classic improper input validation issue where user-controlled data (ID parameter) is directly concatenated into SQL statements without using prepared statements, parameterized queries, or proper escaping. The affected product is code-projects Online Shoe Store 1.0, a small-scale e-commerce platform vulnerable in its administrative interface. CPE notation would be: cpe:2.3:a:code-projects:online_shoe_store:1.0:*:*:*:*:*:*:*

RemediationAI

Immediate actions: (1) Implement input validation: whitelist ID parameter to accept only numeric values using regex or type casting (e.g., (int)$_GET['id']); (2) Use prepared statements with parameterized queries in all SQL operations—replace mysqli_query() or PDO execute() calls with prepared statement versions (mysqli_prepare() + bind_param() or PDO::prepare() + execute()); (3) Apply principle of least privilege to database user account executing queries (read-only for confirmation operations); (4) Disable direct web access to /admin/ directory if possible, or restrict via .htaccess (Deny from all) and authenticate via alternative mechanism; (5) Implement Web Application Firewall (WAF) rules to detect and block common SQL injection payloads (UNION-based, time-based blind, error-based); (6) Conduct full code audit of all user input handling in admin interface. Long-term: upgrade from Online Shoe Store 1.0 to a maintained e-commerce platform (Magento, WooCommerce, Prestashop) with security updates. No official vendor patch is available; contact code-projects development team for guidance.