EUVD-2025-18837
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Tags
Description
A vulnerability was found in code-projects Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /login.php. The manipulation of the argument User leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-6467 is a critical SQL injection vulnerability in code-projects Online Bidding System version 1.0 affecting the /login.php file's User parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially compromise data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, and while the CVSS score of 7.3 indicates high severity, the attack requires no authentication or user interaction, making it highly exploitable in real-world scenarios.
Technical Context
This vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), specifically manifesting as SQL injection in the login authentication mechanism. The /login.php file fails to properly sanitize or parameterize user input from the 'User' parameter before incorporating it into SQL queries, allowing attackers to inject malicious SQL syntax. The Online Bidding System is a PHP-based web application (typically running on Apache/Nginx with MySQL or similar database backends) that lacks input validation and prepared statement usage. The affected component is the authentication layer, a critical trust boundary in web applications. CPE context: cpe:2.3:a:code-projects:online_bidding_system:1.0:*:*:*:*:*:*:*
Affected Products
- product: code-projects Online Bidding System; version: 1.0; cpe: cpe:2.3:a:code-projects:online_bidding_system:1.0:*:*:*:*:*:*:*; affected_component: /login.php; affected_parameter: User; status: vulnerable
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today